Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
PYSEC-2026-4240
  • PyPI/langgraph-sdk
 LangGraph SDK custom auth silently ignores actions= on resource decorators 23 hours ago
  • Fix available
  • Severity - 7.6 (High)
GHSA-fvww-7h3r-vfhp
  • PyPI/langgraph-sdk
 LangGraph SDK custom auth silently ignores actions= on resource decorators 05 Oct
  • Fix available
  • Severity - 7.6 (High)
PYSEC-2026-3860
  • PyPI/langgraph-store-mongodb
 LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure 10 Sep
  • Fix available
  • Severity - 7.7 (High)
PYSEC-2026-3859
  • PyPI/langgraph-checkpoint-mongodb
 LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure 10 Sep
  • Fix available
  • Severity - 7.7 (High)
PYSEC-2026-3858
  • PyPI/langgraph-api
 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation 10 Sep
  • Fix available
  • Severity - 5.9 (Medium)
PYSEC-2026-3857
  • PyPI/langgraph-api
 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication 10 Sep
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-533j-2v4q-mw5h
  • PyPI/langgraph-checkpoint-mongodb
  • PyPI/langgraph-store-mongodb
 LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure 20 Aug
  • Fix available
  • Severity - 7.7 (High)
GHSA-jfj5-wrj9-63x4
  • PyPI/langgraph-api
 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation 19 Aug
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-2c9q-c2q9-qgqv
  • PyPI/langgraph-api
 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication 19 Aug
  • Fix available
  • Severity - 5.9 (Medium)
PYSEC-2026-3636
  • PyPI/langgraph-checkpoint-sqlite
 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores 10 Aug
  • Fix available
  • Severity - 5.3 (Medium)
PYSEC-2026-3635
  • PyPI/langgraph-checkpoint-postgres
 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores 10 Aug
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-47pj-3jcm-6whg
  • PyPI/langgraph-checkpoint-postgres
  • PyPI/langgraph-checkpoint-sqlite
 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores 06 Aug
  • Fix available
  • Severity - 5.3 (Medium)
PYSEC-2026-2575
  • PyPI/langgraph-sdk
 LangGraph SDK has unsafe URL path construction 13 Jul
  • Fix available
  • Severity - 4.2 (Medium)
PYSEC-2026-2573
  • PyPI/langgraph-checkpoint
 LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading 13 Jul
  • Fix available
  • Severity - 6.8 (Medium)
PYSEC-2026-2574
  • PyPI/langgraph-checkpoint
 LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution 13 Jul
  • Fix available
  • Severity - 6.6 (Medium)
PYSEC-2026-1530
  • PyPI/langgraph-checkpoint-sqlite
 LangGraph's SQLite is vulnerable to SQL injection via metadata filter key in SQLite checkpointer list method 07 Jul
  • Fix available
  • Severity - 7.3 (High)
Load more...