PT-2026-50481

Name of the Vulnerable Software and Affected Versions Open-webui affected versions not specified Description An authenticated user can access files belonging to other users by exploiting a lack of ownership verification in the image processing path. When the POST endpoint "/api/chat/completions"...

Server-side Request Forgery (SSRF)

Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the baseurl parameter in API requests and the resolution of environment variables in the LLM configuration process. An attack...

gpt4docs (>=0.1.0, <=0.2.0), llm-repl (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-55443 via langchain (0.0.261)

langchain PYPI version 0.0.261 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - gpt4docs =0.1.0, =1.0.0, =1.0.1 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

devtale (>=0.1.2, <=0.1.4), gitmaid (0.1.0) +3 more potentially affected by CVE-2026-55443 via langchain (0.0.251)

langchain PYPI version 0.0.251 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - devtale =0.1.2, =0.1.0, =0.4.0, =0.5.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

gpt3discord (>=11.2.2, <=11.2.6), llm-repl (0.0.2) +1 more potentially affected by CVE-2026-55443 via langchain (0.0.133)

langchain PYPI version 0.0.133 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - gpt3discord =11.2.2, =1.2.22, =1.3.11 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

bisheng-langchain (0.2.3.1), evo-researcher (0.1.3) +5 more potentially affected by CVE-2026-55443 via langchain (0.0.349)

langchain PYPI version 0.0.349 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - bisheng-langchain 0.2.3.1 - evo-researcher 0.1.3 - friday-agent 0.1.0 - langchain-experimental =0.0.44, =0.14.1, =0.3.0, =0.3.1 Source cves:...

idoctorai (>=0.8.4, <=0.8.7), llm-monitor (>=0.8.0, <=0.14.0) potentially affected by CVE-2026-55443 via langchain (0.0.299)

langchain PYPI version 0.0.299 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - idoctorai =0.8.4, =0.8.0, =0.14.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

dlsite-recommendation-llm (0.0.0), scrapegraphai (>=0.0.1, <=0.0.9) potentially affected by CVE-2026-55443 via langchain (0.1.6)

langchain PYPI version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - dlsite-recommendation-llm 0.0.0 - scrapegraphai =0.0.1, =0.0.9 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

biochatter (>=0.1.8, <=0.1.18), structure-llm (0.1.0) potentially affected by CVE-2026-55443 via langchain (0.0.147)

langchain PYPI version 0.0.147 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - biochatter =0.1.8, =0.1.18 - structure-llm 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

pyspark-ai (>=0.1.0, <=0.1.12), spark-llm (>=0.1.4, <=0.1.9) potentially affected by CVE-2026-55443 via langchain (0.0.201)

langchain PYPI version 0.0.201 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - pyspark-ai =0.1.0, =0.1.4, =0.1.9 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

git-llm (>=0.1.0, <=0.1.3) potentially affected by CVE-2026-55443 via langchain (0.0.184)

langchain PYPI version 0.0.184 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - git-llm =0.1.0, =0.1.3 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

raft-llm (>=0.1.1, <=0.1.6), ragbuilder (>=0.1.0, <=0.1.5) potentially affected by CVE-2026-55443 via langchain (0.2.9)

langchain PYPI version 0.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - raft-llm =0.1.1, =0.1.0, =0.1.5 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

carton-mcp (>=0.1.80, <=0.1.83), heaven-framework (>=0.1.24, <=0.1.36) +4 more potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.13)

langchain-anthropic PYPI version 0.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - carton-mcp =0.1.80, =0.1.24, =0.1.5, =0.1.0, =0.1.0, =2.6.13, =2.6.22 Source cves: CVE-2026-55443 Source advisory:...

llm-bot (>=0.1.1, <=0.1.3) potentially affected by CVE-2026-55443 via langchain (0.0.224)

langchain PYPI version 0.0.224 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - llm-bot =0.1.1, =0.1.3 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

django-llm (>=0.1.0, <=0.1.3), qabot (0.2.10) potentially affected by CVE-2026-55443 via langchain (0.0.121)

langchain PYPI version 0.0.121 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - django-llm =0.1.0, =0.1.3 - qabot 0.2.10 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

langchain-cli (>=0.0.1, <=0.0.2), langchain-sap-llm (0.1.1) +1 more potentially affected by CVE-2026-55443 via langchain (0.0.139)

langchain PYPI version 0.0.139 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - langchain-cli =0.0.1, =0.0.5, =0.0.6 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

llm-strategy (>=0.0.1.dev0, <=0.0.2) potentially affected by CVE-2026-55443 via langchain (0.0.42)

langchain PYPI version 0.0.42 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - llm-strategy =0.0.1.dev0, =0.0.2 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

brickllm (>=1.0.0, <=1.3.0), process-gpt-llm-factory (1.0.1) potentially affected by CVE-2026-55443 via langchain-anthropic (0.2.1)

langchain-anthropic PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - brickllm =1.0.0, =1.3.0 - process-gpt-llm-factory 1.0.1 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-46...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-54531 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-54531 Source advisory: OSV:GHSA-M2V9-299J-RV96...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-54530 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-54530 Source advisory: OSV:GHSA-52X6-GQ3R-VPF4...