agent-api-server (>=2.1.7, <=2.1.13), alphasix-axiom (>=1.1.3, <=1.1.22) +17 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=3.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =3.0.0, =2.1.7, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.1.0, =0.8.0, =0.11.1, =0.11.1, =1.0.0.dev7, =1.0.0, =1.0.0.dev7, =3.60.0 and more Source cves: CVE-2026-71433 Source advisory: OSV:PYSEC-2026-3635...

superset-chat (>=0.1.0a1, <=0.1.0a24) potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.0)

langgraph-checkpoint-postgres PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - superset-chat =0.1.0a1, =0.1.0a24 Source cves: CVE-2026-71433 Source advisory: OSV:PYSEC-2026-3635...

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

SummaryThe Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...

gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +1 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (1.0.0)

langgraph-checkpoint-postgres PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =1.2.13 Source cves: CVE-2026-71433 Source advisory...

airflow-chat (>=0.1.0a2, <=0.1.0a7), doorbeen (0.0.1) +10 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.25)

langgraph-checkpoint-postgres PYPI version 2.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - airflow-chat =0.1.0a2, =0.0.2, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.7.7...

Neon Database URL Validation

Parses leaked Neon postgres:// URLs .neon.tech and validates Neon Management API keys against /api/v2/projects. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Validate leaked Neon database URLs and Management API keys.""" from kittysploit import from...

EUVD-2026-54476

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

CVE-2026-71433

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

@fedify/amqp (0.2.0-dev.12), @fedify/botkit (>=0.3.0-dev.125, <=0.4.0-dev.175) +3 more potentially affected by CVE-2026-62857 via @fedify/fedify (>=1.5.0-dev.732, <=1.9.2)

@fedify/fedify NPM version =1.5.0-dev.732, =0.3.0-dev.125, =0.4.0-dev.167, =0.3.0-dev.20, =0.4.0-dev.18, =0.4.0 Source cves: CVE-2026-62857 Source advisory: MEND:CVE-2026-62857...

agent-api-server (>=2.1.7, <=2.1.13), alphasix-axiom (>=1.1.3, <=1.1.22) +17 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=3.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =3.0.0, =2.1.7, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.1.0, =0.8.0, =0.11.1, =0.11.1, =1.0.0.dev7, =1.0.0, =1.0.0.dev7, =3.60.0 and more Source cves: CVE-2026-71433 Source advisory: GHSA-47PJ-3JCM-6WHG...

langgraph-agent-toolkit (>=0.7.8, <=0.7.23), mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.21)

langgraph-checkpoint-postgres PYPI version 2.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - langgraph-agent-toolkit =0.7.8, =0.1.0, =0.1.1 Source cves: CVE-2026-71433 Source advisory:...

Incorrect Authorization

Overview langgraph-checkpoint-postgres is a Library with a Postgres implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Incorrect Authorization in the search or listnamespaces process. An attacker can access data from unintended namespaces by crafting...

airflow-chat (>=0.1.0a2, <=0.1.0a7), doorbeen (0.0.1) +10 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.25)

langgraph-checkpoint-postgres PYPI version 2.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - airflow-chat =0.1.0a2, =0.0.2, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.7.7...

superset-chat (>=0.1.0a1, <=0.1.0a24) potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.0)

langgraph-checkpoint-postgres PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - superset-chat =0.1.0a1, =0.1.0a24 Source cves: CVE-2026-71433 Source advisory: OSV:GHSA-47PJ-3JCM-6WHG...

agent-api-server (>=2.1.7, <=2.1.13), alphasix-axiom (>=1.1.3, <=1.1.22) +17 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=3.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =3.0.0, =2.1.7, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.1.0, =0.8.0, =0.11.1, =0.11.1, =1.0.0.dev7, =1.0.0, =1.0.0.dev7, =3.60.0 and more Source cves: CVE-2026-71433 Source advisory: SNYK:PYTHON-LANGGRAPHCHECKPOINTPOSTGRES-18592348...

gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +1 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (1.0.0)

langgraph-checkpoint-postgres PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =1.2.13 Source cves: CVE-2026-71433 Source advisory...

agent-api-server (>=2.1.7, <=2.1.13), alphasix-axiom (>=1.1.3, <=1.1.22) +17 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=3.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =3.0.0, =2.1.7, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.1.0, =0.8.0, =0.11.1, =0.11.1, =1.0.0.dev7, =1.0.0, =1.0.0.dev7, =3.60.0 and more Source cves: CVE-2026-71433 Source advisory: OSV:GHSA-47PJ-3JCM-6WHG...

GHSA-47PJ-3JCM-6WHG LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...

CVE-2026-71433

CVE-2026-71433 affects LangGraph checkpoint stores for Postgres and SQLite. Before 3.1.1, langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite persisted hierarchical namespaces as a dot-joined string and used a simple prefix match for reads, allowing an authenticated caller to access ite...

agent-api-server (>=2.1.7, <=2.1.13), airflow-chat (>=0.1.0a2, <=0.1.0a7) +33 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=1.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =1.0.0, =2.1.7, =0.1.0a2, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.0.2, =1.0.0, =1.0.9, =1.2.13 and more Source cves: CVE-2026-71433 Source advisory: MEND:CVE-2026-71433...