CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

6301 matches found

Cvelist•added 2026/07/21 5:31 p.m.•43 views

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

8.3CVSS0.00388EPSS

SaveExploits0References2

EUVD•added 2026/07/21 5:31 p.m.•23 views

EUVD-2026-46339

8.3CVSS5.9AI score0.00388EPSS

SaveExploits0References2

CVE•added 2026/07/21 5:31 p.m.•89 views

CVE-2026-47419

CVE-2026-47419 concerns PraisonAI Platform where agent endpoints under /workspaces/{workspace_id}/agents/{agent_id} suffer an Insecure Direct Object Reference. The description and connected reports show that endpoints gate access with require_workspace_member(workspace_id) but the AgentService.ge...

8.3CVSS5.9AI score0.00388EPSS

SaveExploits0References2

Cvelist•added 2026/07/21 5:26 p.m.•41 views

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

8.1CVSS0.00413EPSS

SaveExploits0References3

CVE•added 2026/07/21 5:26 p.m.•88 views

CVE-2026-47418

Vulnerability: PraisonAI Platform is affected by an insecure direct object reference (IDOR) in project endpoints. The API gates access using require_workspace_member(workspace_id) but does not enforce workspace-scoped lookups for project_id. As a result, a member of one workspace (W1) can read, m...

8.1CVSS5.9AI score0.00413EPSS

SaveExploits0References3

attackerkb•added 2026/07/21 5:26 p.m.•21 views

CVE-2026-47418

8.1CVSS5.9AI score0.00413EPSS

SaveExploits0References4Affected Software1

Vulnrichment•added 2026/07/21 5:26 p.m.•10 views

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

8.1CVSS5.9AI score0.00413EPSS

SaveExploits0References3

EUVD•added 2026/07/21 5:26 p.m.•23 views

EUVD-2026-46337

8.1CVSS5.9AI score0.00413EPSS

SaveExploits0References3

OSV•added 2026/07/21 5:26 p.m.•16 views

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

8.1CVSS5.6AI score

SaveExploits0References5

Cvelist•added 2026/07/21 5:24 p.m.•37 views

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoints POST /workspaces/workspaceid/issues/issueid/comments and GET .../comments gate access on requireworkspacememberworkspaceid...

8.1CVSS0.00363EPSS

SaveExploits0References2

CVE•added 2026/07/21 5:24 p.m.•74 views

CVE-2026-47417

Summary of vulnerability (CVE-2026-47417, PraisonAI Platform) : The comment endpoints POST /workspaces/{workspace_id}/issues/{issue_id}/comments and GET /workspaces/{workspace_id}/issues/{issue_id}/comments are gated by require_workspace_member only on the workspace, but the code paths do not ver...

8.1CVSS5.8AI score0.00363EPSS

SaveExploits0References2

EUVD•added 2026/07/21 5:24 p.m.•20 views

EUVD-2026-46335

8.1CVSS5.8AI score0.00363EPSS

SaveExploits0References2

OSV•added 2026/07/21 5:24 p.m.•15 views

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

8.1CVSS5.5AI score

SaveExploits0References4

attackerkb•added 2026/07/21 5:24 p.m.•28 views

CVE-2026-47417

8.1CVSS5.8AI score0.00363EPSS

SaveExploits0References3Affected Software1

Vulnrichment•added 2026/07/21 5:24 p.m.•13 views

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

8.1CVSS5.8AI score0.00363EPSS

SaveExploits0References2

Vulnrichment•added 2026/07/21 5:19 p.m.•11 views

CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The PATCH /workspaces/workspaceid/members/userid endpoint is gated by requireworkspacememberworkspaceid, which defaults to minrole="member"...

9.6CVSS5.8AI score0.00363EPSS

SaveExploits0References2

Cvelist•added 2026/07/21 5:19 p.m.•39 views

CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

9.6CVSS0.00363EPSS

SaveExploits0References2

EUVD•added 2026/07/21 5:19 p.m.•18 views

EUVD-2026-46334

9.6CVSS5.8AI score0.00363EPSS

SaveExploits0References2

attackerkb•added 2026/07/21 5:19 p.m.•17 views

CVE-2026-47416

9.6CVSS5.8AI score0.00363EPSS

SaveExploits0References3Affected Software1

OSV•added 2026/07/21 5:19 p.m.•16 views

CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

9.6CVSS5.4AI score

SaveExploits0References4

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by