CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

5950 matches found

Vulnrichment•added 2026/07/21 5:07 p.m.•8 views

CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" an...

9.6CVSS5.9AI score0.00363EPSS

SaveExploits0References2

Cvelist•added 2026/07/21 5:07 p.m.•34 views

CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

9.6CVSS0.00363EPSS

SaveExploits0References2

EUVD•added 2026/07/21 5:07 p.m.•16 views

EUVD-2026-46331

9.6CVSS5.4AI score0.00363EPSS

SaveExploits0References2

attackerkb•added 2026/07/21 5:07 p.m.•13 views

CVE-2026-47413

9.6CVSS5.4AI score0.00363EPSS

SaveExploits0References3Affected Software1

CVE•added 2026/07/21 5:07 p.m.•69 views

CVE-2026-47413

Pra sisAI Platform (versions before 0.1.4) is vulnerable to privilege escalation via POST /workspaces/{workspace_id}/members. The endpoint is gated by require_workspace_member (default min_role=member) but forwards body.user_id and body.role directly to MemberService.add(), which does not perform...

9.6CVSS5.8AI score0.00363EPSS

SaveExploits0References2

OSV•added 2026/07/21 5:07 p.m.•14 views

CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

9.6CVSS5.5AI score

SaveExploits0References4

EUVD•added 2026/07/21 5:04 p.m.•14 views

EUVD-2026-46330

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The DELETE /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any membe...

8.1CVSS5.4AI score0.00525EPSS

SaveExploits0References3

Cvelist•added 2026/07/21 5:04 p.m.•38 views

CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

8.1CVSS0.00525EPSS

SaveExploits0References3

OSV•added 2026/07/21 5:04 p.m.•13 views

CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

8.1CVSS5.5AI score

SaveExploits0References5

CVE•added 2026/07/21 5:04 p.m.•64 views

CVE-2026-47412

CVE-2026-47412 describes an authorization bypass in PraisonAI Platform: versions prior to 0.1.4 allow any workspace member to delete the entire workspace via DELETE /workspaces/{workspace_id}, because the endpoint is gated only by require_workspace_member with a default min_role of member. The im...

8.1CVSS5.8AI score0.00525EPSS

SaveExploits0References3

Vulnrichment•added 2026/07/21 5:04 p.m.•10 views

CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

8.1CVSS5.9AI score0.00525EPSS

SaveExploits0References3

Cvelist•added 2026/07/21 5:02 p.m.•36 views

CVE-2026-47411 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default...

6.5CVSS0.00335EPSS

SaveExploits0References1

CVE•added 2026/07/21 5:02 p.m.•75 views

CVE-2026-47411

PraisonAI Platform contains an authorization bypass in PATCH /workspaces/{workspace_id}: endpoints guarded by require_workspace_member (default min_role=member) allow any workspace member to rewrite workspace name, description, and the free‑form settings JSON. This can enable configuration inject...

6.5CVSS5.8AI score0.00335EPSS

SaveExploits0References1

OSV•added 2026/07/21 5:02 p.m.•13 views

CVE-2026-47411 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

6.5CVSS5.6AI score

SaveExploits0References3

EUVD•added 2026/07/21 5:02 p.m.•15 views

EUVD-2026-46329

6.5CVSS5.5AI score0.00335EPSS

SaveExploits0References1

Vulnrichment•added 2026/07/21 5:02 p.m.•9 views

CVE-2026-47411 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

6.5CVSS5.9AI score0.00335EPSS

SaveExploits0References1

EUVD•added 2026/07/21 4:53 p.m.•30 views

EUVD-2026-46323

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member"...

8.1CVSS5.5AI score0.00525EPSS

SaveExploits0References3

CVE•added 2026/07/21 4:53 p.m.•72 views

CVE-2026-47409

CVE-2026-47409 affects PraisonAI Platform. Public docs confirm an authorization bypass in DELETE /workspaces/{workspace_id}/members/{user_id}: any workspace member can remove any other member (including the owner) because require_workspace_member defaults to min_role=member and lacks caller/targe...

8.1CVSS5.8AI score0.00525EPSS

SaveExploits0References3

OSV•added 2026/07/21 4:53 p.m.•14 views

CVE-2026-47409 praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

8.1CVSS5.5AI score

SaveExploits0References5

Cvelist•added 2026/07/21 4:53 p.m.•37 views

CVE-2026-47409 praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

8.1CVSS0.00525EPSS

SaveExploits0References3

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by