High
CVE-2026-47394
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 167
Reset filters
High
CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
High
CVE-2026-44338
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Medium
CVE-2026-44337
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
High
CVE-2026-44335
PraisonAI has an SSRF bypass
High
CVE-2026-44334
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Medium
CVE-2026-40315
PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries
Medium
CVE-2026-40159
PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
High
CVE-2026-40114
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
High
CVE-2026-40160
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
Medium
CVE-2026-40152
PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary
Medium
CVE-2026-40117
PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate
High
CVE-2026-40150
PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool
Medium
CVE-2026-40151
PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
Medium
CVE-2026-40148
PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits
High
CVE-2026-40149
PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls
Medium
CVE-2026-40115
PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS
High
CVE-2026-40158
PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure
High
CVE-2026-40156
PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
High
CVE-2026-40153
PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool
Medium
CVE-2026-56078
PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling
High
CVE-2026-40116
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
High
CVE-2026-39891
PraisonAI has Template Injection in Agent Tool Definitions
High
CVE-2026-40113
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.