Vulnerabilities
Summary — last 7 days
New vulnerabilities4,632▼ 625 vs. last week
Critical / high1,863▼ 1,157 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)735▲ 629 vs. last week
More filters
5 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | Critical (9.8) | 1.4% | — | Langchain-experimental | 9/19/2024 | 6/17/2026 | langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). | |
| Modified | High (8.5) | 1.9% | PoC | Langchain-experimental | 7/15/2024 | 6/17/2026 | Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if they can control the… | |
| Analyzed | High (7.8) | 0.23% | — | Langchain-experimental | 6/16/2024 | 6/17/2026 | langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444. | |
| Analyzed | Critical (9.8) | 0.77% | — | Langchain-experimental | 2/26/2024 | 6/17/2026 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not… | |
| Modified | Critical (9.8) | 1.0% | — | Langchain Experimental | 10/9/2023 | 6/17/2026 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py. |