Critical
CVE-2026-57147
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 167
Reset filters
High
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
High
CVE-2026-57143
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
Critical
CVE-2026-57145
PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
Critical
CVE-2026-57148
praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
Critical
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
High
CVE-2026-57130
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
High
CVE-2026-57122
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Critical
CVE-2026-57124
PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
High
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
High
CVE-2026-57113
PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
Critical
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
High
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
High
CVE-2026-56839
PraisonAI Code agent tools fail open without a workspace boundary
High
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Critical
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
High
CVE-2026-57126
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
Medium
CVE-2026-57120
PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
High
CVE-2026-57129
PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
High
CVE-2026-57119
PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
High
CVE-2026-57114
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Critical
CVE-2026-57127
praisonai: recipe serve auth middleware silently disables itself when no secret is set
Critical
CVE-2026-57131
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
Medium
CVE-2026-57115
PraisonAI: SpiderTools redirect-target SSRF protection bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.