Vulnerabilities in mervinpraison
178 resultsCVE-2026-47417HIGHpraisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOREPSS 0.4%CVE-2026-44339HIGHPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeEPSS 0.4%CVE-2026-47399HIGHPraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object IDEPSS 0.4%CVE-2026-47405HIGHPraisonAI Platform missing role checks let any workspace member become owner and take over workspace membershipEPSS 0.4%CVE-2026-55526HIGHPraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)EPSS 0.4%CVE-2026-40117MEDIUMPraisonAIAgents Affected by Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval GateEPSS 0.4%CVE-2026-34936HIGHPraisonAI: SSRF via Unvalidated api_base in passthrough() FallbackEPSS 0.4%CVE-2026-40115MEDIUMPraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Exhaustion DoSEPSS 0.3%CVE-2026-41496HIGHPraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)EPSS 0.3%CVE-2026-47419HIGHpraisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOREPSS 0.3%CVE-2026-47409HIGHpraisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}EPSS 0.3%CVE-2026-61432MEDIUMPraisonAI FastContext before 1.6.78 Path TraversalEPSS 0.3%CVE-2026-55535MEDIUMPraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validationEPSS 0.3%CVE-2026-61439HIGHPraisonAI before 4.6.78 Prompt Injection Defense BypassEPSS 0.3%CVE-2026-39308HIGHPraisonAI recipe registry publish path traversal allows out-of-root file writeEPSS 0.3%CVE-2026-61446HIGHPraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-DiscoveryEPSS 0.3%CVE-2026-60087MEDIUMPraisonAI before 1.6.78 Tool Approval Cache BypassEPSS 0.3%CVE-2026-47411MEDIUMpraisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}EPSS 0.3%CVE-2026-57121HIGHPraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform APIEPSS 0.3%CVE-2026-56836HIGHPraisonAI recipe serve Typer command bypasses the non-localhost authentication guardEPSS 0.3%