Vulnerability (CVE)
A critical serialization injection flaw in LangChain Core, tracked as CVE-2025-68664 with a CVSS score of 9.3, was reported by researcher Yarden Porat on December 4, 2025 and codenamed LangGrinch. The dumps() and dumpd() functions fail to escape...
A newly disclosed MongoDB vulnerability, CVE-2025-14847 (CVSS 8.7) and codenamed MongoBleed, is under active exploitation and allows an unauthenticated attacker to remotely leak sensitive data from server memory. Censys counts more than 87,000 potentially...
Researchers disclosed three vulnerabilities in LangChain and LangGraph that could expose filesystem data, environment secrets, and conversation history, with LangChain, LangChain-Core, and LangGraph downloaded more than 52 million, 23 million, and 9...