Critical
CVE-2026-54769
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 11
Reset filters
High
CVE-2026-54771
Langroid: handle_message() executes user-supplied tool JSON without sender verification
Critical
CVE-2026-54760
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Critical
CVE-2026-55615
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
High
CVE-2026-50181
Langroid: Path traversal in the file tools allows read/write outside configured current directory
High
CVE-2026-50180
Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
High
CVE-2025-46725
Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
High
CVE-2025-46726
Langroid Allows XXE Injection via XMLToolMessage
Critical
CVE-2026-25879
Langroid has Prompt to SQL Injection, Leading to RCE
Critical
CVE-2025-46724
Langroid has a Code Injection vulnerability in TableChatAgent
Critical
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.