CVE-2026-55529

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream validateorigin method accepts requestorigin.startswithallowed, so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit...

CVE-2026-55529

PraisonAI (a multi-agent teams system) has an origin validation bypass in its MCP HTTP Stream transport. The _validate_origin method uses request_origin.startswith(allowed), so an attacker-controlled origin like http://localhost.evil.example matches the http://localhost allowlist entry via prefix...

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

Summary PraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the Origin header. The default localhost allowlist includes origins such as http://localhost, and the validation accepts any origin that starts with an allowed value. As a result, an attacker-controlled orig...

GHSA-WJ6G-V78P-6FX3 PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

Summary PraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the Origin header. The default localhost allowlist includes origins such as http://localhost, and the validation accepts any origin that starts with an allowed value. As a result, an attacker-controlled orig...

PT-2026-81320

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The MCP HTTP Stream transport in PraisonAI uses an unsafe prefix match when validating the Origin header via the validate origin method. The validation logic accepts any origin that starts with an...

Incorrect Authorization

Overview org.springframework.ai:spring-ai-model is a Core model interfaces and classes for Spring AI Affected versions of this package are vulnerable to Incorrect Authorization through the DefaultToolCallingManager in...

CVE-2026-65975

A flaw was found in Pydantic AI's UI adapters, specifically within the sanitizemessages function. This vulnerability allows a remote client to bypass security checks and execute server tools with arguments they provide, rather than those generated by the AI model. This occurs when a trailing clie...

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-18830

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...

PT-2026-67789

Name of the Vulnerable Software and Affected Versions Amazon Bedrock AgentCore affected versions not specified Description Insufficient input validation in the AgentCore harness may allow an authenticated remote user to execute configured tools. This is achieved by using crafted content blocks in...

CVE-2026-18830: Improper Validation of Specified Type of Input

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...

GHSA-5P9G-J988-PCWV MCP Ruby SDK: Ruby SSE Session Poisoning

Summary Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for...

CVE-2026-65975

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters AG-UI via Agent.toagui/AGUIAdapter, and Vercel AI via VercelAIAdapter use...

CVE-2026-65975 Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters AG-UI via Agent.toagui/AGUIAdapter, and Vercel AI via VercelAIAdapter use...

CVE-2026-65975

CVE-2026-65975 affects Pydantic AI AG-UI Adapter (AG-UI via Agent.to_ag_ui()/AGUIAdapter and Vercel AI via VercelAIAdapter) in Pydantic AI versions 1.88.0–1.107.0 and 2.0.0b1–2.4.x. The bug arises because sanitize_messages uses a stripping index computed before sanitization, so when a trailing cl...

CVE-2026-65975 Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters AG-UI via Agent.toagui/AGUIAdapter, and Vercel AI via VercelAIAdapter use...

Incorrect Authorization

Overview google-adk is an Agent Development Kit Affected versions of this package are vulnerable to Incorrect Authorization via the request confirmation processing in requestconfirmation.py. An attacker can execute unauthorized tools by injecting or manipulating session-history events to forge a...

CVE-2026-18236

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

CVE-2026-65975: Incorrect Authorization

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters AG-UI via Agent.toagui/AGUIAdapter, and Vercel AI via VercelAIAdapter use...

PT-2026-65861

Name of the Vulnerable Software and Affected Versions Agent Development Kit affected versions not specified Description An issue allows for continuation forgery in tool confirmations. An attacker capable of manipulating or injecting events into the session history can execute unauthorized tools b...