Vulnerabilities in MervinPraison

158 results
Vexday analysis

O portfólio de vulnerabilidades da MervinPraison apresenta um perfil atípico: todas as 53 CVEs catalogadas surgiram nos últimos 90 dias, indicando um produto recente ou uma fila de divulgação concentrada, e nenhuma delas consta no catálogo CISA KEV, taxa abaixo da média geral. Ainda assim, 18 falhas são classificadas como críticas e a falha mais predominante é CWE-22 (Path Traversal), tipo de vulnerabilidade com potencial significativo de impacto em confidencialidade e integridade de dados. A CVE mais perigosa atualmente, CVE-2026-44338, registra EPSS de 0,268, sugerindo probabilidade não negligenciável de exploração em breve, especialmente considerando a existência de ao menos um PoC público no conjunto. Equipes de segurança devem priorizar a remediação das falhas críticas e monitorar de perto a evolução do EPSS de CVE-2026-44338 diante da ausência de exploração confirmada, mas contexto de exposição crescente.

CVE-2026-47408MEDIUMpraisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownershipEPSS 0.4%CVE-2026-57138CRITICALPraisonAI codeMode sandbox escape via Function constructorEPSS 0.4%CVE-2026-57136HIGHPraisonAI SandboxExecutor allowedCommands bypass via shell chainingEPSS 0.4%CVE-2026-61427MEDIUMPraisonAI before 4.6.78 Authentication Bypass via HTTP-streamEPSS 0.4%CVE-2026-47415HIGHpraisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOREPSS 0.4%CVE-2026-47419HIGHpraisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOREPSS 0.4%CVE-2026-55539HIGHPraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and deleteEPSS 0.4%CVE-2026-47414HIGHpraisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOREPSS 0.4%CVE-2026-34955HIGHPraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandboxEPSS 0.4%CVE-2026-57126HIGHpraisonaiagents: SSRF guard validates literal IPs only and never resolves DNSEPSS 0.4%CVE-2026-40157CRITICALPraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`EPSS 0.4%CVE-2026-44335HIGHSSRF bypass in PraisonAIEPSS 0.4%CVE-2026-61440HIGHPraisonAI Platform before 0.1.9 Authorization Bypass via Label EndpointsEPSS 0.4%CVE-2026-34953CRITICALPraisonAI: Authentication Bypass in OAuthManager.validate_token()EPSS 0.4%CVE-2026-61428MEDIUMPraisonAI AgentMail before 4.6.78 Message Injection via WebhookEPSS 0.4%CVE-2026-40116HIGHPraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate LimitsEPSS 0.4%CVE-2026-57140CRITICALPraisonAI AgentOS exposes unauthenticated agent listing and invocationEPSS 0.4%CVE-2026-57148CRITICALpraisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)EPSS 0.4%CVE-2026-47416CRITICALpraisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}EPSS 0.4%CVE-2026-47413CRITICALpraisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/membersEPSS 0.4%