Vulnerabilidades en MervinPraison

158 resultados
Análisis Vexday

O portfólio de vulnerabilidades da MervinPraison apresenta um perfil atípico: todas as 53 CVEs catalogadas surgiram nos últimos 90 dias, indicando um produto recente ou uma fila de divulgação concentrada, e nenhuma delas consta no catálogo CISA KEV, taxa abaixo da média geral. Ainda assim, 18 falhas são classificadas como críticas e a falha mais predominante é CWE-22 (Path Traversal), tipo de vulnerabilidade com potencial significativo de impacto em confidencialidade e integridade de dados. A CVE mais perigosa atualmente, CVE-2026-44338, registra EPSS de 0,268, sugerindo probabilidade não negligenciável de exploração em breve, especialmente considerando a existência de ao menos um PoC público no conjunto. Equipes de segurança devem priorizar a remediação das falhas críticas e monitorar de perto a evolução do EPSS de CVE-2026-44338 diante da ausência de exploração confirmada, mas contexto de exposição crescente.

CVE-2026-48169HIGHPraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform APIEPSS 0.3%CVE-2026-55527HIGHPraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable locationEPSS 0.3%CVE-2026-57120MEDIUMPraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunderEPSS 0.3%CVE-2026-39307HIGHPraisonAI has an Arbitrary File Write (Zip Slip) in Templates ExtractionEPSS 0.3%CVE-2026-40152MEDIUMPraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace BoundaryEPSS 0.3%CVE-2026-57135HIGHPraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsEPSS 0.3%CVE-2026-39305CRITICALArbitrary File Write / Path Traversal in Action OrchestratorEPSS 0.3%CVE-2026-57134HIGHPraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validationEPSS 0.3%CVE-2026-40313CRITICALPraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential PersistenceEPSS 0.3%CVE-2026-40154CRITICALPraisonAI Affected by Untrusted Remote Template Code ExecutionEPSS 0.3%CVE-2026-56839HIGHPraisonAI Code agent tools fail open without a workspace boundaryEPSS 0.3%CVE-2026-60091MEDIUMPraisonAI before 4.6.78 Unauthenticated SSRF via webhook_urlEPSS 0.3%CVE-2026-40315HIGHPraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queriesEPSS 0.3%CVE-2026-61438HIGHPraisonAI before 4.6.78 Remote Code Execution via Broken AST SandboxEPSS 0.3%CVE-2026-39306HIGHPraisonAI recipe registry pull path traversal writes files outside the chosen output directoryEPSS 0.3%CVE-2026-55525HIGHPraisonAI: SSRF via redirect-following in praisonaiagents web_crawlEPSS 0.3%CVE-2026-55536CRITICALBrowser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)EPSS 0.3%CVE-2026-57132HIGHPraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationEPSS 0.3%CVE-2026-40114HIGHPraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs APIEPSS 0.3%CVE-2026-55541HIGHPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforcedEPSS 0.3%