CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

6396 matches found

Cvelist•added 2026/07/21 5:31 p.m.•46 views

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

8.3CVSS0.00388EPSS

SaveExploits0References2

osv_cve•added 2026/07/21 5:31 p.m.•19 views

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

8.3CVSS5.5AI score

SaveExploits0References4

attackerkb•added 2026/07/21 5:31 p.m.•19 views

CVE-2026-47419

8.3CVSS5.8AI score0.00388EPSS

SaveExploits0References3Affected Software1

EUVD•added 2026/07/21 5:31 p.m.•26 views

EUVD-2026-46339

8.3CVSS5.8AI score0.00388EPSS

SaveExploits0References2

Vulnrichment•added 2026/07/21 5:31 p.m.•15 views

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

8.3CVSS5.8AI score0.00388EPSS

SaveExploits0References2

CVE•added 2026/07/21 5:26 p.m.•88 views

CVE-2026-47418

Vulnerability: PraisonAI Platform is affected by an insecure direct object reference (IDOR) in project endpoints. The API gates access using require_workspace_member(workspace_id) but does not enforce workspace-scoped lookups for project_id. As a result, a member of one workspace (W1) can read, m...

8.1CVSS5.8AI score0.00413EPSS

SaveExploits0References3

osv_cve•added 2026/07/21 5:26 p.m.•18 views

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

8.1CVSS5.6AI score

SaveExploits0References5

Cvelist•added 2026/07/21 5:26 p.m.•44 views

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

8.1CVSS0.00413EPSS

SaveExploits0References3

Vulnrichment•added 2026/07/21 5:26 p.m.•11 views

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

8.1CVSS5.8AI score0.00413EPSS

SaveExploits0References3

attackerkb•added 2026/07/21 5:26 p.m.•22 views

CVE-2026-47418

8.1CVSS5.8AI score0.00413EPSS

SaveExploits0References4Affected Software1

EUVD•added 2026/07/21 5:26 p.m.•24 views

EUVD-2026-46337

8.1CVSS5.8AI score0.00413EPSS

SaveExploits0References3

Cvelist•added 2026/07/21 5:24 p.m.•42 views

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoints POST /workspaces/workspaceid/issues/issueid/comments and GET .../comments gate access on requireworkspacememberworkspaceid...

8.1CVSS0.00363EPSS

SaveExploits0References2

CVE•added 2026/07/21 5:24 p.m.•74 views

CVE-2026-47417

Summary of vulnerability (CVE-2026-47417, PraisonAI Platform) : The comment endpoints POST /workspaces/{workspace_id}/issues/{issue_id}/comments and GET /workspaces/{workspace_id}/issues/{issue_id}/comments are gated by require_workspace_member only on the workspace, but the code paths do not ver...

8.1CVSS5.8AI score0.00363EPSS

SaveExploits0References2

osv_cve•added 2026/07/21 5:24 p.m.•22 views

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

8.1CVSS5.5AI score

SaveExploits0References4

attackerkb•added 2026/07/21 5:24 p.m.•29 views

CVE-2026-47417

8.1CVSS5.8AI score0.00363EPSS

SaveExploits0References3Affected Software1

EUVD•added 2026/07/21 5:24 p.m.•22 views

EUVD-2026-46335

8.1CVSS5.8AI score0.00363EPSS

SaveExploits0References2

Vulnrichment•added 2026/07/21 5:24 p.m.•13 views

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

8.1CVSS5.8AI score0.00363EPSS

SaveExploits0References2

EUVD•added 2026/07/21 5:19 p.m.•20 views

EUVD-2026-46334

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The PATCH /workspaces/workspaceid/members/userid endpoint is gated by requireworkspacememberworkspaceid, which defaults to minrole="member"...

9.6CVSS5.8AI score0.00363EPSS

SaveExploits0References2

Cvelist•added 2026/07/21 5:19 p.m.•41 views

CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

9.6CVSS0.00363EPSS

SaveExploits0References2

Vulnrichment•added 2026/07/21 5:19 p.m.•11 views

CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

9.6CVSS5.8AI score0.00363EPSS

SaveExploits0References2

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by