Critical
CVE-2026-57118
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 185
Reset filters
High
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
High
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
High
CVE-2026-56839
PraisonAI Code agent tools fail open without a workspace boundary
High
CVE-2026-57126
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
Medium
CVE-2026-57120
PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
High
CVE-2026-57114
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Medium
CVE-2026-57115
PraisonAI: SpiderTools redirect-target SSRF protection bypass
High
CVE-2026-56838
PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
High
CVE-2026-56835
PraisonAI Slack app_mention bypasses configured user/channel authorization
High
CVE-2026-56837
PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
High
CVE-2026-56834
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
High
CVE-2026-56836
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
High
CVE-2026-56833
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
High
CVE-2026-56832
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
High
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
High
CVE-2026-50181
Langroid: Path traversal in the file tools allows read/write outside configured current directory
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
Medium
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
High
CVE-2026-54008
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
Medium
CVE-2026-46448
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Medium
CVE-2026-47411
praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}
High
CVE-2026-47418
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
High
CVE-2026-47417
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.