Security advisories

high2026-10-05

CVE-2026-104873-LangGraph SDK custom auth silently ignores actions= on resource decorators

View chart →

langchain-ai/langgraph · GHSA-fvww-7h3r-vfhp

medium2026-10-05

CVE-2026-104182-stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

View chart →

uhop/stream-json · GHSA-hqr4-qq8f-hg3x

medium2026-10-05

CVE-2026-104183-stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

View chart →

uhop/stream-json · GHSA-mjw6-4jj6-33hc

high2026-10-05

CVE-2026-92959-vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

View chart →

patriksimek/vm2 · GHSA-f8gf-w286-fmq2

critical2026-10-05

CVE-2026-92955-vm2: Sandbox Escape (NodeVM)

View chart →

patriksimek/vm2 · GHSA-88hf-g992-jg85

critical2026-10-05

CVE-2026-92954-vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

View chart →

patriksimek/vm2 · GHSA-gjq8-xm47-88rc

critical2026-10-05

CVE-2026-92953-vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

View chart →

patriksimek/vm2 · GHSA-3vgf-8m4q-q4qr

critical2026-10-05

CVE-2026-92934-vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

View chart →

patriksimek/vm2 · GHSA-x965-fc75-jpqh

medium2026-10-05

CVE-2026-92933-vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack

View chart →

patriksimek/vm2 · GHSA-r273-hxvj-fxhp

high2026-10-05

CVE-2026-104847-ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

View chart →

prosemirror/prosemirror-view · GHSA-c8x8-7fp4-3x9w

medium2026-10-05

CVE-2026-92936-vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

View chart →

patriksimek/vm2 · GHSA-x6m4-chr9-cg97

high2026-10-05

CVE-2026-92942-vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

View chart →

patriksimek/vm2 · GHSA-r4fx-v8hh-22mv

critical2026-10-05

CVE-2026-92946-vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

View chart →

patriksimek/vm2 · GHSA-j3hm-6rg5-mchv

critical2026-10-05

CVE-2026-92947-vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

View chart →

patriksimek/vm2 · GHSA-fcqc-726x-5wfc

critical2026-10-05

CVE-2026-92956-vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

View chart →

patriksimek/vm2 · GHSA-wjwh-qqvp-g4p4

medium2026-10-05

CVE-2026-105751-Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

View chart →

docling-project/docling · GHSA-4xhp-xg4w-8ppm

medium2026-10-05

CVE-2026-74866-@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

View chart →

fastify/busboy · GHSA-gxm5-99cw-xjw9

critical2026-10-05

CVE-2026-9205-Langflow: Weak Fernet Key via random.seed()

View chart →

langflow-ai/langflow · GHSA-jxw3-mjmx-3pqm

critical2026-10-05

CVE-2026-8505-Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

View chart →

langflow-ai/langflow · GHSA-cf6m-vc3m-7cgm

high2026-10-05

CVE-2026-51886-Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

View chart →

langflow-ai/langflow · GHSA-w584-2h2r-2hvf