Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 157

Export CSV
CVE-2026-57130

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonaiagents
CVE-2026-57125

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai Praisonaiagents
CVE-2026-57115

PraisonAI: SpiderTools redirect-target SSRF protection bypass

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrape_page and its extract_links, crawl, and extract_text callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai Praisonaiagents
CVE-2026-57128

PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-57123

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonaiagents
CVE-2026-57126

praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-56839

PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-57131

praisonai: Jobs API exposes agent-execution endpoints with no authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-57145

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55536

Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55540

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55534

PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55529

PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools. This issue is fixed in version 4.6.58.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55541

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unified_app() do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/{id}/invoke. This issue is fixed in version 4.6.58.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55539

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55527

PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitizes user_id before constructing self.user_path. This issue is fixed in version 1.6.58.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55526

PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai Praisonaiagents
CVE-2026-55535

PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-55528

praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai Praisonaiagents
CVE-2026-55530

PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate. This issue is fixed in version 1.6.58.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai Praisonaiagents