EUVD-2026-77615

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

CVE-2026-57127 praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

CVE-2026-57127

PraisonAI (multi-agent LLM framework on PyPI) prior to 4.6.58 contains a fail-open authentication bypass in praisonai/recipe/serve.py. When an operator sets auth: api-key or auth: jwt in the recipe YAML but fails to provide the corresponding secret (via YAML field or PRAISONAI_API_KEY / PRAISONAI...

CVE-2026-57127 praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

CVE-2026-57127: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

SummaryThe PraisonAI Recipe HTTP server silently allows unauthenticated requests when auth is configured as api-key or jwt but the corresponding secret is missing.This creates an authentication fail-open condition. An operator can start the Recipe server with authentication enabled, including on ...

PYSEC-2026-3889 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

Summary The PraisonAI Recipe HTTP server silently allows unauthenticated requests when auth is configured as api-key or jwt but the corresponding secret is missing. This creates an authentication fail-open condition. An operator can start the Recipe server with authentication enabled, including o...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

PYSEC-2026-3903 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

Summary PraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset. This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

PYSEC-2026-3891 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

Summary PraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset. This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

CVE-2026-75905

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-75905

The WP Recipe Maker WordPress plugin (versions ≤ 10.8.0 ) has an authorization bypass in class-wprm-recipe-saver.php, where the plugin fails to properly verify user authorization before performing actions. Authenticated attackers with contributor-level access or higher can take ownership of any a...

EUVD-2026-74691

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-75905 WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-75905 WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-75905: Missing Authorization

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-88849

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

WordPress WP Recipe Maker plugin <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Recipe Maker versions = 10.8.0...

SUSE CVE-2026-85623

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...