3350 matches found
Missing Authentication for Critical Function
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...
CVE-2026-55538
PraisonAI is a multi-agent teams system. Prior to version 4.6.58 , the _create_agents_app() function failed to authenticate the POST /agents and POST /agents/{agent_name} routes, even though praisonai serve agents parsed the config["api_key"] value. As a result, requests with missing or incorrect...
GHSA-7WW9-85PG-CV4X PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
Summary PraisonAI's praisonai serve agents command exposes --api-key as the documented authentication control for production/external deployments, but the configured key is not enforced on the public agent invocation compatibility endpoints. An operator can start the server with --api-key and bin...
EUVD-2026-65500
PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but createagentsapp does not authenticate POST /agents or POST /agents/agentname. A network caller can invoke configured agents without credentials even when an API key was...
CVE-2026-55534
PraisonAI (a multi-agent teams system) is affected by an authentication bypass in versions 4.6.34 through 4.6.58 . When using praisonai serve agents, the --api-key flag is accepted but the _create_agents_app() function fails to enforce it on the POST /agents and POST /agents/{agent_name} endpoint...
RHSA-2026:59329 Red Hat Security Advisory: resource-agents security update
Bulletin has no description...
Important: Red Hat Security Advisory: resource-agents security update
An update for resource-agents is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2026-55534: Missing Authentication for Critical Function
PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but createagentsapp does not authenticate POST /agents or POST /agents/agentname. A network caller can invoke configured agents without credentials even when an API key was...
PT-2026-81210
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs readlink reply function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader...
CVE-2026-78379: Undefined Security Weakness
Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...
PT-2026-81489
Name of the Vulnerable Software and Affected Versions Amazon Strands Agents Tools versions prior to 0.8.5 Description Improper neutralization of input used for Large Language Model LLM prompting in the python repl tool allows remote actors to execute arbitrary Python code on the agent's host. Thi...
PT-2026-81206
Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.10-rc5 Description An out-of-bounds write exists in the RLE8 bitmap decoder within the video subsystem. The video display rle8 bitmap function in drivers/video/video bmp.c decodes run-length encoded streams direct...
CVE-2026-55538: Missing Authentication for Critical Function
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config"apikey" but createagentsapp does not authenticate POST /agents or POST /agents/agentname. Missing or incorrect bearer and X-API-Key values still reach agent execution. This issue is fixed in...
CVE-2026-55541: Missing Authorization
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but createagentsapp and createunifiedapp do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/id/invoke. This...
RHEL 7 : resource-agents (RHSA-2026:59329)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59329 advisory. The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several servic...
RHSA-2026:58822 Red Hat Security Advisory: fence-agents security update
Bulletin has no description...
RHSA-2026:58834 Red Hat Security Advisory: resource-agents security update
Bulletin has no description...
RHSA-2026:58835 Red Hat Security Advisory: fence-agents security update
Bulletin has no description...