elevendoc (>=0.1.3, <=1.2.4), llm-adaptive-router (>=0.1.0, <=0.1.12) potentially affected by CVE-2026-34070 via langchain-core (0.3.8)

langchain-core PYPI version 0.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - elevendoc =0.1.3, =0.1.0, =0.1.12 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

langchain-runpod-llm (>=0.0.0, <=0.0.3) potentially affected by CVE-2026-34070 via langchain-core (0.1.18)

langchain-core PYPI version 0.1.18 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langchain-runpod-llm =0.0.0, =0.0.3 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

atom-llm (0.1.0), cori-ai (>=0.0.0, <=1.2.12) +5 more potentially affected by CVE-2026-34070 via langchain-core (0.3.28)

langchain-core PYPI version 0.3.28 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - atom-llm 0.1.0 - cori-ai =0.0.0, =0.7.22, =0.1.3, =0.1.2, =0.1.5 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

process-gpt-llm-factory (1.0.1) potentially affected by CVE-2026-34070 via langchain-core (0.3.2)

langchain-core PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - process-gpt-llm-factory 1.0.1 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

chainlite (0.3.7), cryptocom-agent-client (>=1.0.0, <=1.0.4) +2 more potentially affected by CVE-2026-34070 via langchain-core (0.3.33)

langchain-core PYPI version 0.3.33 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - chainlite 0.3.7 - cryptocom-agent-client =1.0.0, =0.0.1, =0.3.0, =0.4.0 Source cves: CVE-2026-34070 Source advisory:...

EUVD-2026-17146

A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function childprocess.execSync of the file src/server.ts. The manipulation of the argument gitdiff.baseref/gitdiff.files results in os command injection. The attack is only possible with local...

CVE-2026-29872

A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 2026-01-19. The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-wide environment variables using os.environ without...

CVE-2026-5125

A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function childprocess.execSync of the file src/server.ts. The manipulation of the argument gitdiff.baseref/gitdiff.files results in os command injection. The attack is only possible with local...

CVE-2026-5125 raine consult-llm-mcp server.ts child_process.execSync os command injection

A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function childprocess.execSync of the file src/server.ts. The manipulation of the argument gitdiff.baseref/gitdiff.files results in os command injection. The attack is only possible with local...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2025-15379 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2025-15379 Source advisory:...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2025-15379 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2025-15379 Source advisory: OSV:GHSA-R23Q-823P-VMF7...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2025-15379 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2025-15379 Source advisory:...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2025-15379 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2025-15379 Source advisory: OSV:GHSA-R23Q-823P-VMF7...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-15379 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-15379 Source advisory: OSV:GHSA-R23Q-823P-VMF7...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2025-15036 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2025-15036 Source advisory:...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2025-15036 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2025-15036 Source advisory: OSV:GHSA-VHCX-3PQ2-4FVC...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2025-15036 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2025-15036 Source advisory:...

argosml (>=0.0.1, <=0.1.3), bbj-argos (0.0.1) +6 more potentially affected by CVE-2025-15036 via mlflow (2.17.2)

mlflow PYPI version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - argosml =0.0.1, =2.1.3, =0.1.50.4, =0.1.6, =0.1.9.post2 - wedata-pre-code 2.0.2 Source cves: CVE-2025-15036 Source advisory: OSV:GHSA-VHCX-3PQ2-4FV...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-15036 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-15036 Source advisory: OSV:GHSA-VHCX-3PQ2-4FVC...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2025-15036 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2025-15036 Source advisory: OSV:GHSA-VHCX-3PQ2-4FVC...