1638 matches found
CVE-2026-47406: Authorization Bypass Through User-Controlled Key
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints POST/GET /workspaces/workspaceid/issues/issueid/dependencies and DELETE .../dependencies/depid gate access on...
CVE-2026-47408: Authorization Bypass Through User-Controlled Key
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...
CVE-2026-47410: Use of Hard-coded Cryptographic Key
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal "dev-secret-change-me" when PLATFORMJWTSECRET is unset. A safety check exists but only...
CVE-2026-47414: Authorization Bypass Through User-Controlled Key
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...
CVE-2026-47396: Improper Access Control
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALLSERVERTOKEN is not configured. The affected component is the praisonai.api.agentinvoke router as mounted by praisonai.api.call. The...
CVE-2026-47409: Improper Privilege Management
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member"...
CVE-2026-47390: Server-Side Request Forgery (SSRF)
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...
CVE-2026-47392: Incomplete List of Disallowed Inputs
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...
CVE-2026-56840
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:58+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-63v4-w882-g4x2...
CVE-2026-56832
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:19+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m...
CVE-2026-56834
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:15+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j7qx-p75m-wp7g...
CVE-2026-56837
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:06+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q...
CVE-2026-56839
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:02+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gcq3-mfvh-3x25...
CVE-2026-57112
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:59+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx...
CVE-2026-57115
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:57+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h9p-93hq-q7h6...
CVE-2026-57114
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:41+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rjvw-7vvw-549v...
CVE-2026-57124
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:31+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p75f-6fp4-p57w 2026-07-23 17:02:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcvkwlge2r 2026-09-14...
CVE-2026-57126
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:26+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vxgj-xg5c-p4h7 2026-09-14 16:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvii6rhrqp2p 2026-09-14...
CVE-2026-57127
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:24+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4hj-7hfh-g2f4 2026-07-23 16:58:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcoi3qaq2u 2026-09-14...