Login Request a demo
ME
Vendor
MervinPraison
4 products with CVEs on record
194
CVEs
0
On KEV
21
New 30D
Products
PR
PraisonAI
MervinPraison
10.0
147 CVEs0 on KEV18 new
PR
praisonaiagents
MervinPraison
9.9
26 CVEs0 on KEV2 new
PR
praisonai-platform
MervinPraison
9.8
20 CVEs0 on KEV1 new
16
< 1.6.40
MervinPraison
9.9
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-57117
New
PR
PraisonAI
MervinPraison
8.8
0%
Oct 23PraisonAI: Compute-bridged file tools allow shell command injection
CVE-2026-57146
New
PR
PraisonAI
MervinPraison
7.5
0%
Oct 23PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
CVE-2026-57144
New
PR
PraisonAI
MervinPraison
8.8
0%
Oct 23PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
CVE-2026-57142
New
PR
PraisonAI
MervinPraison
7.8
0%
Oct 23PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
CVE-2026-57121
New
PR
PraisonAI
MervinPraison
8.1
0%
Oct 23PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
CVE-2026-57116
New
PR
PraisonAI
MervinPraison
9.8
0%
Oct 23PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
CVE-2026-57114
New
PR
PraisonAI
MervinPraison
7.2
0%
Oct 23PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
CVE-2026-57113
New
PR
PraisonAI
MervinPraison
8.1
0%
Oct 23PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
CVE-2026-56840
New
PR
PraisonAI
MervinPraison
8.8
0%
Oct 23PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
CVE-2026-56838
New
PR
PraisonAI
MervinPraison
7.8
0%
Oct 23PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
CVE-2026-56837
New
PR
PraisonAI
MervinPraison
8.6
0%
Oct 23PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
CVE-2026-56836
New
PR
PraisonAI
MervinPraison
8.2
0%
Oct 23PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
CVE-2026-56835
New
PR
PraisonAI
MervinPraison
8.3
0%
Oct 23PraisonAI Slack app_mention bypasses configured user/channel authorization
CVE-2026-56834
New
PR
PraisonAI
MervinPraison
7.5
0%
Oct 23PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
CVE-2026-56833
New
PR
PraisonAI
MervinPraison
7.5
0%
Oct 23PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
CVE-2026-56832
New
PR
PraisonAI
MervinPraison
8.8
0%
Oct 23PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
CVE-2026-57118
PR
PraisonAI
MervinPraison
9.8
0%
Oct 12PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
CVE-2026-57143
PR
praisonaiagents
MervinPraison
8.8
0%
Oct 12PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
CVE-2026-62176
PR
PraisonAI
MervinPraison
9.1
0%
Oct 7PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
CVE-2026-62179
PR
praisonai-platform
MervinPraison
6.5
0%
Oct 7PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
CVE-2026-57147
PR
PraisonAI
MervinPraison
9.8
1%
Sep 15praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
CVE-2026-57148
PR
PraisonAI
MervinPraison
9.8
1%
Sep 15praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
CVE-2026-57140
PR
PraisonAI
MervinPraison
9.4
1%
Sep 15PraisonAI AgentOS exposes unauthenticated agent listing and invocation
CVE-2026-57139
PR
PraisonAI
MervinPraison
9.8
1%
Sep 15PraisonAI MCPServer exposes unauthenticated HTTP tools/call
CVE-2026-57133
PR
PraisonAI
MervinPraison
8.8
1%
Sep 15PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
CVE-2026-57135
PR
PraisonAI
MervinPraison
7.6
0%
Sep 15PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
CVE-2026-57134
PR
PraisonAI
MervinPraison
8.2
0%
Sep 15PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
CVE-2026-57138
PR
PraisonAI
MervinPraison
9.9
1%
Sep 15PraisonAI codeMode sandbox escape via Function constructor
CVE-2026-57136
PR
PraisonAI
MervinPraison
8.8
1%
Sep 15PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
CVE-2026-57137
PR
PraisonAI
MervinPraison
8.8
1%
Sep 15PraisonAI AgentLoop onToolCall approval runs after tool execution
CVE-2026-57141
PR
PraisonAI
MervinPraison
9.8
1%
Sep 15PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
CVE-2026-57112
PR
PraisonAI
MervinPraison
8.3
0%
Sep 15PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
CVE-2026-57145
PR
PraisonAI
MervinPraison
9.1
1%
Sep 14PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
CVE-2026-57132
PR
PraisonAI
MervinPraison
8.2
1%
Sep 14PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
CVE-2026-57131
PR
PraisonAI
MervinPraison
9.8
1%
Sep 14praisonai: Jobs API exposes agent-execution endpoints with no authentication
CVE-2026-57124
PR
PraisonAI
MervinPraison
9.8
1%
Sep 14PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
CVE-2026-57122
PR
PraisonAI
MervinPraison
8.6
0%
Sep 14PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
CVE-2026-57127
PR
PraisonAI
MervinPraison
9.8
1%
Sep 14praisonai: recipe serve auth middleware silently disables itself when no secret is set
CVE-2026-56839
PR
PraisonAI
MervinPraison
7.3
0%
Sep 14PraisonAI Code agent tools fail open without a workspace boundary
CVE-2026-57119
PR
PraisonAI
MervinPraison
7.5
1%
Sep 14PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API
CVE-2026-57129
PR
praisonaiagents
MervinPraison
7.5
1%
Sep 14PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
CVE-2026-57126
PR
PraisonAI
MervinPraison
8.5
0%
Sep 14praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
CVE-2026-57120
PR
praisonaiagents
MervinPraison
6.5
1%
Sep 14PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
CVE-2026-57123
PR
praisonaiagents
MervinPraison
9.8
1%
Sep 14PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
CVE-2026-57130
PR
praisonaiagents
MervinPraison
8.1
0%
Sep 14PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
CVE-2026-57128
PR
PraisonAI
MervinPraison
4.3
0%
Sep 14PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint
CVE-2026-57115
PR
praisonaiagents
MervinPraison
6.5
0%
Sep 14PraisonAI: SpiderTools redirect-target SSRF protection bypass
CVE-2026-57125
PR
praisonaiagents
MervinPraison
9.8
1%
Sep 14PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
CVE-2026-55536
PR
PraisonAI
MervinPraison
9.1
1%
Aug 25Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
CVE-2026-55532
PR
PraisonAI
MervinPraison
7.6
0%
Aug 25PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
CVE-2026-55533
PR
PraisonAI
MervinPraison
8.2
0%
Aug 25PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
CVE-2026-55539
PR
PraisonAI
MervinPraison
8.6
1%
Aug 25PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
CVE-2026-55527
PR
PraisonAI
MervinPraison
7.1
0%
Aug 25PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
CVE-2026-55541
PR
PraisonAI
MervinPraison
8.8
0%
Aug 25PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
CVE-2026-55535
PR
PraisonAI
MervinPraison
6.8
0%
Aug 25PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
CVE-2026-55537
PR
PraisonAI
MervinPraison
7.1
0%
Aug 25PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
CVE-2026-55538
PR
PraisonAI
MervinPraison
7.3
0%
Aug 25PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
CVE-2026-55540
PR
PraisonAI
MervinPraison
7.1
0%
Aug 25PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
CVE-2026-55530
PR
PraisonAI
MervinPraison
6.1
0%
Aug 25PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
CVE-2026-55534
PR
PraisonAI
MervinPraison
8.6
0%
Aug 25PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution