High
CVE-2026-44339
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 167
Reset filters
Critical
CVE-2026-44336
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
High
CVE-2026-41496
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
Critical
CVE-2026-41497
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
Critical
CVE-2026-40289
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
Critical
CVE-2026-40288
PraisonAI has critical RCE via `type: job` workflow YAML
High
CVE-2026-40287
PraisonAI Vulnerable to RCE via Automatic tools.py Import
Medium
CVE-2026-56074
PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands
High
ghsa-x462-jjpc-q4q4
PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
Critical
CVE-2026-40157
PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
Critical
CVE-2026-40154
PraisonAI Vulnerable Untrusted Remote Template Code Execution
High
CVE-2026-56075
PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution
Critical
CVE-2026-40111
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
Critical
CVE-2026-40088
PraisonAI Vulnerable to OS Command Injection
Critical
CVE-2026-39888
PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
Critical
CVE-2026-39890
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
Critical
CVE-2026-35615
PraisonAI Has Path Traversal in FileTools
Critical
CVE-2026-39305
PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
Critical
CVE-2026-34953
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
Critical
CVE-2026-34952
PraisonAI Has Missing Authentication in WebSocket Gateway
Critical
CVE-2026-34934
PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`
Critical
CVE-2026-34935
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Critical
CVE-2026-34938
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.