Vulnerabilidades en mervinpraison
178 resultadosCVE-2026-47397HIGHPraisonAI has an Arbitrary File Write in Python APIEPSS 0.5%CVE-2026-55534HIGHPraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent executionEPSS 0.5%CVE-2026-34952CRITICALPraisonAI: Missing Authentication in WebSocket GatewayEPSS 0.5%CVE-2026-55531MEDIUMPraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)EPSS 0.5%CVE-2026-55538HIGHPraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticatedEPSS 0.4%CVE-2026-47410CRITICALpraisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unsetEPSS 0.4%CVE-2026-48169HIGHPraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform APIEPSS 0.4%CVE-2026-47396CRITICALPraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unsetEPSS 0.4%CVE-2026-44340HIGHPraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`EPSS 0.4%CVE-2026-39889HIGHPraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U ServerEPSS 0.4%CVE-2026-35615CRITICALPraisonAI has a Path Traversal in FileToolsEPSS 0.4%CVE-2026-57115MEDIUMPraisonAI: SpiderTools redirect-target SSRF protection bypassEPSS 0.4%CVE-2026-61427MEDIUMPraisonAI before 4.6.78 Authentication Bypass via HTTP-streamEPSS 0.4%CVE-2026-40088CRITICALImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonaiEPSS 0.4%CVE-2026-40289CRITICALPraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessionsEPSS 0.4%CVE-2026-34939MEDIUMPraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()EPSS 0.4%CVE-2026-40152MEDIUMPraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace BoundaryEPSS 0.4%CVE-2026-57135HIGHPraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsEPSS 0.4%CVE-2026-57116CRITICALPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocationEPSS 0.4%CVE-2026-57134HIGHPraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validationEPSS 0.4%