a-data-processing (0.0.1), ab-data-processing (0.0.1) +45 more potentially affected by CVE-2026-55443 via langchain (0.0.354)

langchain PYPI version 0.0.354 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - a-data-processing 0.0.1 - ab-data-processing 0.0.1 - aicommit =0.0.1, =0.2.0, =0.0.13, =0.1.14, =0.1.15, =0.5.0a1, =0.0.4, =0.1.6, =0.3.0,...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-49461 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-49461 Source advisory:...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-49460 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-49460 Source advisory:...

crewai (>=0.61.0, <=0.70.1), giga-agent (>=0.1.3, <=0.1.9) +3 more potentially affected by CVE-2026-31245 via mem0ai (0.1.115)

mem0ai PYPI version 0.1.115 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - crewai =0.61.0, =0.1.3, =0.1.1, =0.1.1, =2.0.0 Source cves: CVE-2026-31245 Source advisory: OSV:GHSA-CGX8-QGVR-F7VF...

crewai (>=0.61.0, <=0.70.1), giga-agent (>=0.1.3, <=0.1.9) +3 more potentially affected by CVE-2026-31241 via mem0ai (0.1.115)

mem0ai PYPI version 0.1.115 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - crewai =0.61.0, =0.1.3, =0.1.1, =0.1.1, =2.0.0 Source cves: CVE-2026-31241 Source advisory: OSV:GHSA-GQ6F-QWV9-RF4J...

crewai (>=0.61.0, <=0.70.1), giga-agent (>=0.1.3, <=0.1.9) +3 more potentially affected by CVE-2026-31240 via mem0ai (0.1.115)

mem0ai PYPI version 0.1.115 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - crewai =0.61.0, =0.1.3, =0.1.1, =0.1.1, =2.0.0 Source cves: CVE-2026-31240 Source advisory: OSV:GHSA-JFV9-68M5-GJJR...

agentiq-mem0ai (>=1.1.0a20250502, <=1.1.0a20250505), aiqtoolkit-mem0ai (>=1.1.0a20250429, <=1.5.0a20260130) +18 more potentially affected by CVE-2026-31245 via mem0ai (0.1.118)

mem0ai PYPI version 0.1.118 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - agentiq-mem0ai =1.1.0a20250502, =1.1.0a20250429, =0.13.0, =0.1.122, =0.0.2, =0.1.0.dev7, =0.1.0, =0.0.19, =1.0.0a1, =1.1.0a20251020, =1.2.0, =1.11...

crewai (>=0.61.0, <=0.70.1), giga-agent (>=0.1.3, <=0.1.9) +3 more potentially affected by CVE-2026-7597 via mem0ai (0.1.115)

mem0ai PYPI version 0.1.115 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - crewai =0.61.0, =0.1.3, =0.1.1, =0.1.1, =2.0.0 Source cves: CVE-2026-7597 Source advisory: OSV:GHSA-XQXW-R767-67M7...

actbench (0.0.1a5), agent-framework-mem0 (>=1.0.0b260319, <=1.0.0b260609) +49 more potentially affected by CVE-2026-7597 via mem0ai (>=0.0.5, <=1.0.11)

mem0ai PYPI version =0.0.5, =1.0.0b260319, =1.1.0a20250502, =1.1.0a20250429, =0.1.41, =1.0.4, =0.61.0, =0.13.0, =0.1.108, =0.1.117, =0.1.120a1, =0.1.120, =0.1.0, =0.3.0, =0.3.1 and more Source cves: CVE-2026-7597 Source advisory: MEND:CVE-2026-7597...

bitefix (>=0.0.1, <=0.0.4), changing-dot (>=0.0.1a1, <=0.0.1a9) +8 more potentially affected by CVE-2026-41488 via langchain-openai (0.0.2.post1)

langchain-openai PYPI version 0.0.2.post1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bitefix =0.0.1, =0.0.1a1, =0.1.32, =0.0.1, =0.0.0, =0.0.1, =0.1.0, =0.2.0, =2.0.160, =2.0.171 - vcr-langchain 0.0.31 Sourc...

agentlite-llm (0.1.12), codeqai (>=0.0.11, <=0.0.19) +17 more potentially affected by CVE-2026-41488 via langchain-openai (0.0.5)

langchain-openai PYPI version 0.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - agentlite-llm 0.1.12 - codeqai =0.0.11, =0.0.1rc1, =0.11.1, =0.2.0, =0.0.3, =0.0.2, =0.3.0, =0.0.4, =0.0.5 - py-chronicler 0.1.0...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-41314 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-41314 Source advisory:...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-41312 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-41312 Source advisory:...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-40260 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-40260 Source advisory:...

CVE-2026-2287

CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation...

EUVD-2026-17119

CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server...

EUVD-2026-17123

CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation...

EUVD-2026-17117

The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling...

Server-side Request Forgery (SSRF)

Overview crewai is a Cutting-edge framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks. Affected versions of this package are vulnerable to Server-side Request Forgery SS...

Server-side Request Forgery (SSRF)

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the RAG search tools not properly validating user-supplied URLs at runtime. An attacker can access internal or cloud resources by supplying...