Vulnerabilities
Summary — last 7 days
New vulnerabilities5,032▲ 199 vs. last week
Critical / high2,142▼ 632 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)773▲ 710 vs. last week
More filters
4 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Medium (6.9) | 0.30% | — | Quarkus Langchain4jAI | 10/11/2026 | 10/16/2026 | Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes… | |
| Awaiting Analysis | Low (1.2) | 0.38% | — | Langchain4jAI | 9/25/2026 | 9/28/2026 | A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote exploitation of the… | |
| Awaiting Analysis | High (7.6) | 0.47% | — | Langchain4jAILangchain4j-mariadbAILangchain4j-pgvectorAI | 7/10/2026 | 7/13/2026 | LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without… | |
| Deferred | Medium (6.9) | 0.27% | — | Langchain4j-aideephinAI | 1/6/2025 | 6/17/2026 | LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0. |