https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:54:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-252013 EUVD-2026-252013 https://cve.radiocsirt.org/vuln/euvd-2026-252013 https://cve.radiocsirt.org/vuln/fkie_cve-2025-6984 <p>The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.</p> <p>The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-6984 https://cve.radiocsirt.org/vuln/ghsa-pc6w-59fv-rh23 <p><strong>Affected:</strong> PyPI: langchain-community</p> <p>The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.</p> <p><strong>Affected:</strong> PyPI: langchain-community</p> <p>The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.</p> https://cve.radiocsirt.org/vuln/ghsa-pc6w-59fv-rh23 https://cve.radiocsirt.org/vuln/pysec-2026-1515 <p><strong>Affected:</strong> PyPI: langchain-community</p> <p>The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.</p> <p><strong>Affected:</strong> PyPI: langchain-community</p> <p>The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1515 https://cve.radiocsirt.org/vuln/rhsa-2025:16514 <p>llama_index: Denial of Service (DOS) in JSONReader in run-llama/llama_index langchain-community: Langchain-community insecure XML parsing django: Django SQL injection in FilteredRelation column aliases</p> <p>llama_index: Denial of Service (DOS) in JSONReader in run-llama/llama_index langchain-community: Langchain-community insecure XML parsing django: Django SQL injection in FilteredRelation column aliases</p> https://cve.radiocsirt.org/vuln/rhsa-2025:16514