Mervinpraison vulnerabilities
178 CVEs and advisories name Mervinpraison as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-47394PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
- CVE-2026-47393PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
- CVE-2026-47392PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
- CVE-2026-47391PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
- CVE-2026-47390PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
- CVE-2026-61446PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery
- CVE-2026-61443PraisonAI before 1.6.78 Remote Code Execution via SkillTools
- CVE-2026-61440PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints
- CVE-2026-61438PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox
- CVE-2026-61436PraisonAI before 4.6.78 Missing Webhook Signature Verification
- CVE-2026-61435PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing
- CVE-2026-61433PraisonAI before 4.6.78 Code Injection via API deployment generator
- CVE-2026-61430PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl
- CVE-2026-61427PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream
- CVE-2026-60087PraisonAI before 1.6.78 Tool Approval Cache Bypass
- CVE-2026-60085PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox
- CVE-2026-61447PraisonAI before 1.6.78 Remote Code Execution via CodeAgent
- CVE-2026-61445PraisonAI before 4.6.78 Arbitrary File Write and Command Execution
- CVE-2026-61442PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH
- CVE-2026-61439PraisonAI before 4.6.78 Prompt Injection Defense Bypass
- CVE-2026-61429PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
- CVE-2026-61428PraisonAI AgentMail before 4.6.78 Message Injection via Webhook
- CVE-2026-61426PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults
- CVE-2026-60090PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension
- CVE-2026-60088PraisonAI before 4.6.78 Path Traversal via Custom Commands
- CVE-2026-61444PraisonAI before 4.6.78 Code Injection via f-string
- CVE-2026-61441PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies
- CVE-2026-61437PraisonAI before 1.6.78 Remote Code Execution via tools.py
- CVE-2026-61434PraisonAI before 4.6.78 Allowlist Bypass via find -exec
- CVE-2026-61432PraisonAI FastContext before 1.6.78 Path Traversal