Where
-Infinity
0

Trending

Last week
Last month
Last year

PraisonAI praisonaiPraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

Risk 47
Severity
8.7
First published (updated )
CVE-2026-44340

pypi/praisonaiPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute

Risk 64
Severity
8.6
First published (updated )
CVE-2026-44339

PraisonAI praisonaiPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

Risk 54
Severity
7.3
First published (updated )
CVE-2026-44338

PraisonAI praisonaiPraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

Risk 46
Severity
6.3
First published (updated )
CVE-2026-44337

PraisonAI PraisonAI MCPPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection

Risk 80
Severity
9.4
First published (updated )
CVE-2026-44336
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

MervinPraison PraisonAIIncomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI

Risk 86
Severity
9.8
First published (updated )
CVE-2026-41497

pypi/praisonaiPraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

Risk 60
Severity
8.1
First published (updated )
CVE-2026-41496

pip/praisonaiPraisonAI: Unauthenticated RCE via `tool_override.py`

Risk 74
Severity
8.4
First published (updated )
CVE-2026-44334

PraisonAI praisonaiPraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence

Risk 66
Severity
9.1
First published (updated )
CVE-2026-40313

PraisonAI praisonaiPraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

Risk 66
Severity
9.1
First published (updated )
CVE-2026-40289
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

PraisonAI praisonaiPraisonAI: Critical RCE via `type: job` workflow YAML

Risk 86
Severity
9.8
First published (updated )
CVE-2026-40288

PraisonAI praisonaiPraisonAI has RCE via Automatic tools.py Import

Risk 74
Severity
8.4
First published (updated )
CVE-2026-40287

pypi/praisonaiPraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries

Risk 86
Severity
7.2
First published (updated )
CVE-2026-40315

pip/PraisonAIPraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution

Risk 31
Severity
5.5
First published (updated )
CVE-2026-40159

pip/PraisonAIPraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonai

Risk 70
Severity
8.6
First published (updated )
CVE-2026-40158
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

pip/PraisonAIPraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`

Risk 80
Severity
9.4
First published (updated )
CVE-2026-40157

pip/praisonaiPraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading

Risk 68
Severity
7.8
First published (updated )
CVE-2026-40156

pip/PraisonAIPraisonAI Affected by Untrusted Remote Template Code Execution

Risk 80
Severity
9.6
First published (updated )
CVE-2026-40154

pip/PraisonAIPraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

Risk 27
Severity
5.3
First published (updated )
CVE-2026-40151

pip/PraisonAIPraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls

Risk 51
Severity
7.9
First published (updated )
CVE-2026-40149
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

pip/PraisonAIPraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits

Risk 37
Severity
6.5
First published (updated )
CVE-2026-40148

pip/PraisonAIPraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

Risk 43
Severity
7.5
First published (updated )
CVE-2026-40116

pip/PraisonAIPraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Exhaustion DoS

Risk 43
Severity
7.5
First published (updated )
CVE-2026-40115

pip/PraisonAIPraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

Risk 73
Severity
10
First published (updated )
CVE-2026-40114

pip/PraisonAIPraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

Risk 59
Severity
8.4
First published (updated )
CVE-2026-40113
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

pip/PraisonAIPraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)

Risk 38
Severity
6.1
First published (updated )
CVE-2026-40112

pip/PraisonAIImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

Risk 80
Severity
9.7
First published (updated )
CVE-2026-40088

pip/praisonaiPraisonAI has a Template Injection in Agent Tool Definitions

Risk 79
Severity
8.8
First published (updated )
CVE-2026-39891

pip/praisonaiPraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server

Risk 43
Severity
7.5
First published (updated )
CVE-2026-39889

pip/praisonaiagentsPraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

Risk 83
Severity
10
First published (updated )
CVE-2026-39888
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203