PT-2026-61794

Summary The published npm package praisonai ships a TypeScript AgentOS HTTP server that defaults to host: "0.0.0.0" and registers sensitive agent routes without any authentication or authorization middleware. When a developer starts AgentOS, a network attacker who can reach the service can: - rea...

PT-2026-53131

Summary The published npm package praisonai ships a TypeScript AgentOS HTTP server that defaults to host: "0.0.0.0" and registers sensitive agent routes without any authentication or authorization middleware. When a developer starts AgentOS, a network attacker who can reach the service can: - rea...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-10803 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-10803 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-195...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-4035 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-4035 Source advisory: OSV:GHSA-G35P-PX32-WHV6...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-4035 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-4035 Source advisory: OSV:PYSEC-2026-2222...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-3198 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-3198 Source advisory: OSV:GHSA-R5M9-WM49-959F...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-2651 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-2651 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-2651 Source advisory: OSV:PYSEC-2026-2220...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-2734 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-2734 Source advisory: OSV:GHSA-W5XQ-C4PF-GHQ7...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-2652 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-2652 Source advisory: OSV:GHSA-75CM-X2W3-8MGF...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-2652 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-2652 Source advisory: OSV:PYSEC-2026-2221...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-2614 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-2614 Source advisory: OSV:GHSA-42H5-H8QH-VV9V...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-2393 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-2393 Source advisory: OSV:GHSA-65H7-C7C4-MGHX...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-2393 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-2393 Source advisory: OSV:PYSEC-2026-2219...

EUVD-2026-21172

PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS...

CVE-2026-40151 PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no...

CVE-2026-40151

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no...

CVE-2026-40151: Exposure of Sensitive Information to an Unauthorized Actor

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-33866 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-33866 Source advisory: OSV:GHSA-46R5-X6JQ-V8G6...