[{"data":1,"prerenderedAt":603},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-5711":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":42,"summary":61,"kind":77,"entity":78,"evidence":114,"related":126},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-07-20T14:37:29.537Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-07-20T14:36:19.763Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.28.0","2026-02-20T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":31,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":36,"parsedFileCount":37,"parseErrorCount":32,"unsupportedFileCount":38,"evaluatedVersionCount":39,"metadataResolvedCount":40,"metadataNotFoundCount":41,"osvEvaluatedVersionCount":39,"codeRadarRepositoryCount":30},30,29,1,17,4,20,33,32,0,4205,4191,14,{"componentParserSchemaVersion":43,"candidateBoundary":44,"resolvedVersionBoundary":45,"manifestRangesResolved":46,"latestVersionSubstitution":46,"containerTagsVulnerabilityChecked":46,"osvClaim":47,"depsDevLicenseSemantics":48,"providerSemantics":49,"generativeAiUsed":46,"scoreUsed":46,"treeEntryCeiling":50,"fileByteCeiling":51,"uniqueVersionCeiling":52,"observedFormats":53},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,5000,[54,55,56,57,58,59,60],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":62,"aiPackageCount":63,"resolvedComponentCount":64,"resolvedVersionCount":39,"providerExposureRepositoryCount":65,"licenseExpressionCount":66,"knownLicensePackageCount":67,"unknownLicensePackageCount":68,"advisoryCount":69,"matchedAdvisoryRepositoryCount":70,"topPackage":71},2831,41,7181,7,57,2796,35,572,25,{"id":72,"slug":73,"label":74,"repositoryCount":75,"repositoryShare":76},"package:pypi:openai","openai-0dd26ac5","OpenAI SDK",18,0.6,"repository",{"id":79,"slug":80,"gitlabProjectId":81,"name":82,"pathWithNamespace":83,"description":84,"webUrl":85,"commitSha":86,"commitUrl":87,"lastActivityAt":88,"headCommittedAt":89,"tree":90,"files":93,"resolvedComponentCount":35,"artifactResolvedComponentCount":38,"exactManifestPinCount":35,"packageCount":94,"ecosystems":95,"aiPackageCount":94,"licenseExpressionCount":97,"unknownLicensePackageCount":38,"advisoryIds":98,"advisoryCount":112,"providers":113},"opencode:5711","opencode-5711",5711,"Chat","f13\u002Fmicroservices\u002Fchat","Chat-Microservice mit lokal deployten oder extern verfügbaren Sprachmodellen","https:\u002F\u002Fgitlab.opencode.de\u002Ff13\u002Fmicroservices\u002Fchat","a93870fdf9bd76e9b0e5000a4c35906b58dc77d5","https:\u002F\u002Fgitlab.opencode.de\u002Ff13\u002Fmicroservices\u002Fchat\u002F-\u002Fcommit\u002Fa93870fdf9bd76e9b0e5000a4c35906b58dc77d5","2026-07-20T14:18:13.965Z","2026-07-13T14:12:05.000Z",{"complete":91,"entryCount":92,"truncated":46},true,133,[],10,[96],"pypi",3,[99,100,101,102,103,104,105,106,107,108,109,110,111],"GHSA-2g6r-c272-w58r","GHSA-3644-q5cj-c5c7","GHSA-5chr-fjjv-38qv","GHSA-6qv9-48xg-fc7f","GHSA-926x-3r5x-gfhw","GHSA-c67j-w6g6-q2cm","GHSA-g48c-2wqr-h844","GHSA-gr75-jv2w-4656","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54","GHSA-r7w7-9xr2-qq2r","GHSA-w39p-vh2g-g8g5","PYSEC-2024-323",13,[],{"files":115,"occurrenceCount":35},[116,122],{"path":117,"kind":118,"sourceUrl":119,"commitSha":86,"blobSha":120,"state":121,"componentCount":94},"requirements-dev.txt","exact-manifest-pin","https:\u002F\u002Fgitlab.opencode.de\u002Ff13\u002Fmicroservices\u002Fchat\u002F-\u002Fblob\u002Fa93870fdf9bd76e9b0e5000a4c35906b58dc77d5\u002Frequirements-dev.txt","cb5de92f20847716cb1365424c1487ef7737c5a3","parsed",{"path":123,"kind":118,"sourceUrl":124,"commitSha":86,"blobSha":125,"state":121,"componentCount":94},"requirements.txt","https:\u002F\u002Fgitlab.opencode.de\u002Ff13\u002Fmicroservices\u002Fchat\u002F-\u002Fblob\u002Fa93870fdf9bd76e9b0e5000a4c35906b58dc77d5\u002Frequirements.txt","a6eda97cd26e2e09417c240a3db1e9a304e099d2",{"packages":127,"vulnerabilities":230},[128,141,151,161,174,183,192,201,211,220],{"id":129,"slug":130,"identity":131,"label":132,"aiRelevant":91,"provider":133,"advisoryCount":65,"licenseExpressions":134,"versions":136,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":140},"package:pypi:langchain-core","langchain-core-82117efb","pypi:langchain-core","LangChain Core",null,[135],"MIT",[137,138],"1.4.6","1.4.8",2,[117,123],{"id":142,"slug":143,"identity":144,"label":145,"aiRelevant":91,"provider":133,"advisoryCount":97,"licenseExpressions":146,"versions":147,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":150},"package:pypi:langchain","langchain-2b3b6a0b","pypi:langchain","LangChain",[135],[148,149],"1.3.11","1.3.8",[117,123],{"id":152,"slug":153,"identity":154,"label":155,"aiRelevant":91,"provider":133,"advisoryCount":139,"licenseExpressions":156,"versions":157,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":160},"package:pypi:langgraph","langgraph-6c1c645e","pypi:langgraph","LangGraph",[135],[158,159],"1.2.4","1.2.7",[117,123],{"id":162,"slug":163,"identity":164,"label":165,"aiRelevant":91,"provider":166,"advisoryCount":32,"licenseExpressions":169,"versions":170,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":173},"package:pypi:langchain-openai","langchain-openai-4985188e","pypi:langchain-openai","LangChain OpenAI",{"id":167,"label":168},"openai","OpenAI",[135],[171,172],"1.3.0","1.3.3",[117,123],{"id":72,"slug":73,"identity":175,"label":74,"aiRelevant":91,"provider":176,"advisoryCount":38,"licenseExpressions":177,"versions":179,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":182},"pypi:openai",{"id":167,"label":168},[178],"Apache-2.0",[180,181],"2.41.1","2.44.0",[117,123],{"id":184,"slug":185,"identity":186,"label":187,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":188,"versions":189,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":191},"package:pypi:langchain-linkup","langchain-linkup-d50e0d4b","pypi:langchain-linkup","LangChain · Linkup",[135],[190],"0.2.1",[117,123],{"id":193,"slug":194,"identity":195,"label":196,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":197,"versions":198,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":200},"package:pypi:langchain-mcp-adapters","langchain-mcp-adapters-1c0e13c7","pypi:langchain-mcp-adapters","LangChain · MCP Adapters",[135],[199],"0.3.0",[117,123],{"id":202,"slug":203,"identity":204,"label":205,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":206,"versions":207,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":210},"package:pypi:langchain-protocol","langchain-protocol-2715aeed","pypi:langchain-protocol","LangChain · Protocol",[135],[208,209],"0.0.16","0.0.18",[117,123],{"id":212,"slug":213,"identity":214,"label":215,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":216,"versions":217,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":219},"package:pypi:langchain-tavily","langchain-tavily-432e1c93","pypi:langchain-tavily","LangChain · Tavily",[135],[218],"0.2.18",[117,123],{"id":221,"slug":222,"identity":223,"label":224,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":225,"versions":227,"dossier":91,"occurrenceCount":139,"directOccurrenceCount":38,"evidenceFiles":229},"package:pypi:tiktoken","tiktoken-06b251a3","pypi:tiktoken","tiktoken",[226],"non-standard",[228],"0.13.0",[117,123],[231,265,299,327,354,388,422,449,476,498,533,556,585],{"id":99,"slug":232,"dossier":46,"summary":233,"aliases":234,"sourceIds":237,"published":238,"modified":239,"checkedAt":7,"severity":240,"references":244,"versionKeys":262,"packageCount":32,"repositoryCount":139},"ghsa-2g6r-c272-w58r-4bbbcb01","LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages",[235,236],"CVE-2026-26013","PYSEC-2026-2562",[99,236],"2026-02-11T14:23:13Z","2026-07-13T16:43:30.756724986Z",[241],{"type":242,"score":243},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[245,248,251,253,256,258,260],{"type":246,"url":247},"WEB","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",{"type":249,"url":250},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26013",{"type":246,"url":252},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F2b4b1dc29a833d4053deba4c2b77a3848c834565",{"type":254,"url":255},"PACKAGE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain",{"type":246,"url":257},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.11",{"type":254,"url":259},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-core",{"type":249,"url":261},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",[263,264],"pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7",{"id":100,"slug":266,"dossier":46,"summary":267,"aliases":268,"sourceIds":273,"published":274,"modified":275,"checkedAt":7,"severity":276,"references":279,"versionKeys":294,"packageCount":97,"repositoryCount":97},"ghsa-3644-q5cj-c5c7-4c578cf2","LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning",[269,270,271,272],"CVE-2026-45134","PYSEC-2026-2555","PYSEC-2026-2560","PYSEC-2026-2582",[100,270,271,272],"2026-05-13T15:29:30Z","2026-07-13T16:43:39.736848907Z",[277],{"type":242,"score":278},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[280,282,284,286,288,290,292],{"type":246,"url":281},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk\u002Fsecurity\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":249,"url":283},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45134",{"type":254,"url":285},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk",{"type":254,"url":287},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain",{"type":249,"url":289},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":254,"url":291},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-classic",{"type":254,"url":293},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangsmith",[295,296,297,298],"pypi:langchain-classic@1.0.1","pypi:langchain@0.2.7","pypi:langchain@0.3.7","pypi:langsmith@0.6.4",{"id":101,"slug":300,"dossier":46,"summary":301,"aliases":302,"sourceIds":305,"published":306,"modified":307,"checkedAt":7,"severity":308,"references":311,"versionKeys":326,"packageCount":32,"repositoryCount":32},"ghsa-5chr-fjjv-38qv-5f3dd755","langchain-core allows unauthorized users to read arbitrary files from the host file system",[303,304],"CVE-2024-10940","PYSEC-2026-1517",[101,304],"2025-03-20T12:32:41Z","2026-07-07T17:56:35.905913395Z",[309],{"type":242,"score":310},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[312,314,316,318,320,321,323,324],{"type":249,"url":313},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-10940",{"type":246,"url":315},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F7d481f10102f43559cc57bcad7eba291067939ee",{"type":246,"url":317},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc1e742347f9701aadba8920e4d1f79a636e50b68",{"type":246,"url":319},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fe711034713259ae448981bc0fd1d7a5671499c31",{"type":254,"url":255},{"type":246,"url":322},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fbe1ee1cb-2147-4ff4-a57b-b6045271cf27",{"type":254,"url":259},{"type":249,"url":325},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5chr-fjjv-38qv",[263],{"id":102,"slug":328,"dossier":46,"summary":329,"aliases":330,"sourceIds":333,"published":334,"modified":335,"checkedAt":7,"severity":336,"references":340,"versionKeys":353,"packageCount":32,"repositoryCount":32},"ghsa-6qv9-48xg-fc7f-6f0bc426","LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates",[331,332],"CVE-2025-65106","PYSEC-2026-1518",[102,332],"2025-11-20T17:42:12Z","2026-07-07T17:57:16.939269197Z",[337],{"type":338,"score":339},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[341,343,345,347,349,350,351],{"type":246,"url":342},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",{"type":249,"url":344},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-65106",{"type":246,"url":346},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc4b6ba254e1a49ed91f2e268e6484011c540542a",{"type":246,"url":348},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Ffa7789d6c21222b85211755d822ef698d3b34e00",{"type":254,"url":255},{"type":254,"url":259},{"type":249,"url":352},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",[263],{"id":103,"slug":355,"dossier":46,"summary":356,"aliases":357,"sourceIds":360,"published":361,"modified":362,"checkedAt":7,"severity":363,"references":366,"versionKeys":387,"packageCount":32,"repositoryCount":139},"ghsa-926x-3r5x-gfhw-b7d12e65","LangChain has incomplete f-string validation in prompt templates",[358,359],"CVE-2026-40087","PYSEC-2026-2563",[103,359],"2026-04-08T21:51:32Z","2026-07-13T16:42:42.901211235Z",[364],{"type":242,"score":365},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[367,369,371,373,375,377,379,380,382,384,385],{"type":246,"url":368},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",{"type":249,"url":370},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40087",{"type":246,"url":372},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36612",{"type":246,"url":374},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36613",{"type":246,"url":376},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F6bab0ba3c12328008ddca3e0d54ff5a6151cd27b",{"type":246,"url":378},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Faf2ed47c6f008cdd551f3c0d87db3774c8dfe258",{"type":254,"url":255},{"type":246,"url":381},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.84",{"type":246,"url":383},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.28",{"type":254,"url":259},{"type":249,"url":386},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",[263,264],{"id":104,"slug":389,"dossier":46,"summary":390,"aliases":391,"sourceIds":394,"published":395,"modified":396,"checkedAt":7,"severity":397,"references":400,"versionKeys":421,"packageCount":32,"repositoryCount":32},"ghsa-c67j-w6g6-q2cm-a4c5c0cf","LangChain serialization injection vulnerability enables secret extraction in dumps\u002Floads APIs",[392,393],"CVE-2025-68664","PYSEC-2026-373",[104,393],"2025-12-23T18:46:13Z","2026-07-02T13:00:05.018724776Z",[398],{"type":242,"score":399},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:L\u002FA:N",[401,403,405,407,409,411,413,414,416,418,419],{"type":246,"url":402},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",{"type":249,"url":404},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68664",{"type":246,"url":406},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34455",{"type":246,"url":408},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34458",{"type":246,"url":410},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8",{"type":246,"url":412},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fd9ec4c5cc78960abd37da79b0250f5642e6f0ce6",{"type":254,"url":255},{"type":246,"url":415},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.81",{"type":246,"url":417},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.5",{"type":254,"url":259},{"type":249,"url":420},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",[263],{"id":105,"slug":423,"dossier":46,"summary":424,"aliases":425,"sourceIds":428,"published":429,"modified":430,"checkedAt":7,"severity":431,"references":436,"versionKeys":445,"packageCount":32,"repositoryCount":97},"ghsa-g48c-2wqr-h844-48f35247","LangGraph checkpoint loading has unsafe msgpack deserialization",[426,427],"CVE-2026-28277","PYSEC-2026-83",[105,427],"2026-03-05T20:16:15.677Z","2026-06-06T01:00:08.116125988Z",[432,434],{"type":242,"score":433},"CVSS:3.1\u002FAV:A\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":242,"score":435},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[437,439,441,443],{"type":249,"url":438},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-g48c-2wqr-h844",{"type":249,"url":440},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28277",{"type":254,"url":442},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph",{"type":246,"url":444},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph\u002FPYSEC-2026-83.yaml",[446,447,448],"pypi:langgraph@0.1.1","pypi:langgraph@0.3.21","pypi:langgraph@1.0.6",{"id":106,"slug":450,"dossier":46,"summary":451,"aliases":452,"sourceIds":456,"published":457,"modified":458,"checkedAt":7,"severity":459,"references":464,"versionKeys":473,"packageCount":32,"repositoryCount":34},"ghsa-gr75-jv2w-4656-a5b8c61e","LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders",[453,454,455],"CVE-2026-55443","PYSEC-2026-2192","PYSEC-2026-2556",[106,454],"2026-06-16T15:03:14Z","2026-07-13T16:43:09.845932020Z",[460,462],{"type":242,"score":461},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":242,"score":463},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[465,467,469,472],{"type":249,"url":466},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-gr75-jv2w-4656",{"type":249,"url":468},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55443",{"type":470,"url":471},"FIX","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fdcaf7795a3e6590af55c3ff7bda6add6355e9ea6",{"type":254,"url":255},[296,297,474,475],"pypi:langchain@1.2.6","pypi:langchain@1.3.8",{"id":107,"slug":477,"dossier":46,"summary":478,"aliases":479,"sourceIds":482,"published":483,"modified":484,"checkedAt":7,"severity":485,"references":488,"versionKeys":497,"packageCount":32,"repositoryCount":139},"ghsa-pjwx-r37v-7724-2297a72a","LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists",[480,481],"CVE-2026-44843","PYSEC-2026-2564",[107,481],"2026-05-08T23:07:32Z","2026-07-13T16:42:39.210995356Z",[486],{"type":242,"score":487},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[489,491,493,494,495],{"type":246,"url":490},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",{"type":249,"url":492},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44843",{"type":254,"url":255},{"type":254,"url":259},{"type":249,"url":496},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",[263,264],{"id":108,"slug":499,"dossier":46,"summary":500,"aliases":501,"sourceIds":504,"published":505,"modified":506,"checkedAt":7,"severity":507,"references":510,"versionKeys":532,"packageCount":32,"repositoryCount":139},"ghsa-qh6h-p6c9-ff54-caf42ff5","LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions",[502,503],"CVE-2026-34070","PYSEC-2026-2193",[108,503],"2026-03-27T19:45:00Z","2026-07-13T07:26:33.913236655Z",[508],{"type":242,"score":509},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[511,514,516,518,519,521,523,525,527,529],{"type":512,"url":513},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-qh6h-p6c9-ff54",{"type":249,"url":515},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34070",{"type":470,"url":517},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F27add913474e01e33bededf4096151130ba0d47c",{"type":254,"url":255},{"type":249,"url":520},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core==1.2.22",{"type":246,"url":522},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-34070",{"type":246,"url":524},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-34070.json",{"type":249,"url":526},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24766",{"type":249,"url":528},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":530,"url":531},"REPORT","https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2453287",[263,264],{"id":109,"slug":534,"dossier":46,"summary":535,"aliases":536,"sourceIds":539,"published":540,"modified":541,"checkedAt":7,"severity":542,"references":545,"versionKeys":553,"packageCount":32,"repositoryCount":139},"ghsa-r7w7-9xr2-qq2r-7a3a0a91","langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding",[537,538],"CVE-2026-41488","PYSEC-2026-76",[109,538],"2026-04-16T23:00:12Z","2026-06-06T01:15:07.912179267Z",[543],{"type":242,"score":544},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[546,548,550,551],{"type":249,"url":547},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-r7w7-9xr2-qq2r",{"type":249,"url":549},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-41488",{"type":254,"url":255},{"type":246,"url":552},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flangchain-openai\u002FPYSEC-2026-76.yaml",[554,555],"pypi:langchain-openai@0.2.8","pypi:langchain-openai@1.1.7",{"id":110,"slug":557,"dossier":46,"summary":558,"aliases":559,"sourceIds":563,"published":564,"modified":565,"checkedAt":7,"severity":566,"references":571,"versionKeys":583,"packageCount":139,"repositoryCount":139},"ghsa-w39p-vh2g-g8g5-47880dfe","LangGraph SDK has unsafe URL path construction",[560,561,562],"CVE-2026-48776","PYSEC-2026-2194","PYSEC-2026-2575",[110,561,562],"2026-06-17T10:55:15.113Z","2026-07-13T16:42:27.619863658Z",[567,569],{"type":242,"score":568},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":242,"score":570},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[572,574,576,577,579,581],{"type":246,"url":573},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",{"type":249,"url":575},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48776",{"type":254,"url":442},{"type":246,"url":578},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Freleases\u002Ftag\u002Fsdk%3D%3D0.3.15",{"type":254,"url":580},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flanggraph-sdk",{"type":249,"url":582},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",[584,446],"pypi:langgraph-sdk@0.3.3",{"id":111,"slug":586,"dossier":46,"summary":133,"aliases":587,"sourceIds":591,"published":592,"modified":593,"checkedAt":7,"severity":594,"references":597,"versionKeys":602,"packageCount":32,"repositoryCount":32},"pysec-2024-323-1dd96856",[588,589,590],"CVE-2024-5998","GHSA-f2jm-rw3h-6phg","PYSEC-2026-1514",[111],"2024-09-17T12:15:02.977Z","2026-07-13T07:26:23.643495355Z",[595],{"type":242,"score":596},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[598,600],{"type":470,"url":599},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F604dfe2d99246b0c09f047c604f0c63eafba31e7",{"type":512,"url":601},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Ffa3a2753-57c3-4e08-a176-d7a3ffda28fe",[296],1784558562175]