Mervinpraison vulnerabilities

Products

• Praisonai 153
• Praisonaiagents 26
• Praisonai-platform 20
• Featured Image 2

Newest

• mervinpraison praisonai Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) CVE-2026-55536 Fix available 9.1 CriticalAugust 25, 2026
• mervinpraison praisonai PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server CVE-2026-55532 Fix available 7.6 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret CVE-2026-55533 Fix available 8.2 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete CVE-2026-55539 Fix available 8.6 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location CVE-2026-55527 Fix available 7.1 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced CVE-2026-55541 Fix available 8.8 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation CVE-2026-55535 Fix available 6.8 MediumAugust 25, 2026
• mervinpraison praisonai PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114 CVE-2026-55537 Fix available 7.1 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated CVE-2026-55538 Fix available 7.3 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks CVE-2026-55540 Fix available 7.1 HighAugust 25, 2026
• mervinpraison praisonai, praisonaiagents +1 more PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool CVE-2026-55530 Fix available 6.1 MediumAugust 25, 2026
• mervinpraison praisonai PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution CVE-2026-55534 Fix available 8.6 HighAugust 25, 2026
• mervinpraison praisonai, praisonaiagents +1 more PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) CVE-2026-55526 Fix available 8.5 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced) CVE-2026-55531 Fix available 6.5 MediumAugust 25, 2026
• mervinpraison praisonai, praisonaiagents +1 more praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) CVE-2026-55528 Fix available 8.2 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server CVE-2026-55529 Fix available 6.9 MediumAugust 25, 2026
• mervinpraison praisonai, praisonaiagents +1 more PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl CVE-2026-55525 Fix available 7.5 HighAugust 25, 2026
• mervinpraison praisonai PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) CVE-2026-55524 Fix available 7.5 HighAugust 5, 2026
• mervinpraison praisonai PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets CVE-2026-55523 Fix available 7.7 HighAugust 5, 2026
• mervinpraison praisonai, praisonaiagents +1 more PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code CVE-2026-55522 Fix available 7.8 HighAugust 5, 2026
• mervinpraison praisonai PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name CVE-2026-48168 10.0 CriticalAugust 5, 2026
• mervinpraison praisonai PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery CVE-2026-61446 Fix available 8.6 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI before 1.6.78 Remote Code Execution via SkillTools CVE-2026-61443 Fix available 8.6 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints CVE-2026-61440 Fix available 7.1 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox CVE-2026-61438 Fix available 7.0 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Missing Webhook Signature Verification CVE-2026-61436 Fix available 8.8 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing CVE-2026-61435 Fix available 8.8 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Code Injection via API deployment generator CVE-2026-61433 Fix available 8.5 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl CVE-2026-61430 Fix available 8.4 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream CVE-2026-61427 Fix available 6.9 MediumJuly 15, 2026
• mervinpraison praisonai PraisonAI before 1.6.78 Tool Approval Cache Bypass CVE-2026-60087 Fix available 6.9 MediumJuly 15, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox CVE-2026-60085 Fix available 8.7 HighJuly 15, 2026
• mervinpraison praisonai PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVE-2026-61447 Public exploitFix available EPSS 15.2% 10.0 CriticalJuly 11, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Arbitrary File Write and Command Execution CVE-2026-61445 Fix available 9.4 CriticalJuly 11, 2026
• mervinpraison praisonai PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH CVE-2026-61442 Fix available 7.1 HighJuly 11, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Prompt Injection Defense Bypass CVE-2026-61439 Fix available 8.7 HighJuly 11, 2026
• mervinpraison praisonai PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend CVE-2026-61429 Fix available 8.4 HighJuly 11, 2026
• mervinpraison praisonai PraisonAI AgentMail before 4.6.78 Message Injection via Webhook CVE-2026-61428 Fix available 6.9 MediumJuly 11, 2026
• mervinpraison praisonai PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults CVE-2026-61426 Fix available 8.8 HighJuly 11, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension CVE-2026-60090 Fix available 9.3 CriticalJuly 11, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Path Traversal via Custom Commands CVE-2026-60088 Fix available 6.8 MediumJuly 11, 2026
• mervinpraison praisonai PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation CVE-2026-62176 Fix available 9.1 CriticalJuly 10, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Code Injection via f-string CVE-2026-61444 9.4 CriticalJuly 10, 2026
• mervinpraison praisonai-platform PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues CVE-2026-62179 Fix available 6.5 MediumJuly 10, 2026
• mervinpraison praisonai PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies CVE-2026-61441 7.1 HighJuly 10, 2026
• mervinpraison praisonai PraisonAI before 1.6.78 Remote Code Execution via tools.py CVE-2026-61437 Fix available 8.5 HighJuly 10, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Allowlist Bypass via find -exec CVE-2026-61434 Fix available 8.7 HighJuly 10, 2026
• mervinpraison praisonai PraisonAI FastContext before 1.6.78 Path Traversal CVE-2026-61432 Fix available 6.9 MediumJuly 10, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Path Traversal via ContextGatherer CVE-2026-61431 Fix available 6.8 MediumJuly 10, 2026
• mervinpraison praisonai PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url CVE-2026-60091 Fix available 6.9 MediumJuly 10, 2026
• Show olderLoading…