CVE-2026-55523

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:55+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8hjw-25cg-g52h...

CVE-2026-55529

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:53+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3...

CVE-2026-55528

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:51+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7g3p-92qq-8wvh...

CVE-2026-55531

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:48+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wv94-5qcp-6m36...

CVE-2026-55526

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:46+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x44h-65qv-cw74...

CVE-2026-55534

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:44+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7ww9-85pg-cv4x...

CVE-2026-55530

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:39+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfxv-8fw8-rwpv...

CVE-2026-55540

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:37+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8 2026-08-25 18:13:47+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtwgc6uuyp2g 2026-08-25...

CVE-2026-55538

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:33+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r7v3-x45f-g7hp 2026-08-25 17:02:43+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtwcd4gi3x2y 2026-08-25...

CVE-2026-55535

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:28+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9...

CVE-2026-55527

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:24+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gxmw-5f7x-6g22...

CVE-2026-55539

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:21+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2jgc-f764-c5r2...

CVE-2026-55533

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:19+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gfq8-hmph-9gjv...

CVE-2026-55532

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:17+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvph-5j39-v8qc...

CVE-2026-55536

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:14+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g6r-q6gw-w8fg 2026-08-25 18:08:14+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwfybfgai2b 2026-08-25...

CVE-2026-55539

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...

CVE-2026-55536

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55533

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

Permissive Regular Expression

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...