Login Request a demo
PR
Product
praisonaiagents
by MervinPraison · last CVE Oct 12, 2026
26
CVEs
0
On KEV
9.9
Max CVSS
2
New 30D
Vulnerabilities26In the news0Timeline
Severity mix
Critical 6High 11Medium 9Low 0
Severity
All severities26Critical6High11Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add praisonaiagents to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-57143
8.8
0%
Oct 12
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
Affected: < 1.6.62
CVE-2026-40111
8.8
0%
Apr 9
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
Affected: < 1.5.128
CVE-2026-55526
8.5
0%
Aug 25
PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
Affected: < 1.6.58
CVE-2026-40287
8.4
0%
Apr 14
PraisonAI has RCE via Automatic tools.py Import
Affected: < 1.5.140
CVE-2026-57112
8.3
0%
Sep 15
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Affected: >= 0.6.0, < 1.6.59
CVE-2026-55528
8.2
0%
Aug 25
praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)
Affected: < 1.6.58
CVE-2026-57130
8.1
0%
Sep 14
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
Affected: < 1.6.59
CVE-2026-55522
7.8
0%
Aug 5
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Affected: >= 0.12.12, < 1.6.58
CVE-2026-57129
7.5
1%
Sep 14
PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
Affected: < 1.6.59
CVE-2026-55525
7.5
1%
Aug 25
PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl
Affected: < 1.6.58
CVE-2026-40117
7.5
0%
Apr 9
PraisonAIAgents Affected by Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate
Affected: < 1.5.128
Showing 11