Vulnerabilidades em MervinPraison

178 resultados
Análise Vexday

O portfólio de vulnerabilidades da MervinPraison apresenta um perfil atípico: todas as 53 CVEs catalogadas surgiram nos últimos 90 dias, indicando um produto recente ou uma fila de divulgação concentrada, e nenhuma delas consta no catálogo CISA KEV, taxa abaixo da média geral. Ainda assim, 18 falhas são classificadas como críticas e a falha mais predominante é CWE-22 (Path Traversal), tipo de vulnerabilidade com potencial significativo de impacto em confidencialidade e integridade de dados. A CVE mais perigosa atualmente, CVE-2026-44338, registra EPSS de 0,268, sugerindo probabilidade não negligenciável de exploração em breve, especialmente considerando a existência de ao menos um PoC público no conjunto. Equipes de segurança devem priorizar a remediação das falhas críticas e monitorar de perto a evolução do EPSS de CVE-2026-44338 diante da ausência de exploração confirmada, mas contexto de exposição crescente.

CVE-2026-39307HIGHPraisonAI has an Arbitrary File Write (Zip Slip) in Templates ExtractionEPSS 0.3%CVE-2026-61442HIGHPraisonAI Platform before 0.1.9 Authorization Bypass via PATCHEPSS 0.3%CVE-2026-61438HIGHPraisonAI before 4.6.78 Remote Code Execution via Broken AST SandboxEPSS 0.3%CVE-2026-61428MEDIUMPraisonAI AgentMail before 4.6.78 Message Injection via WebhookEPSS 0.3%CVE-2026-39305CRITICALArbitrary File Write / Path Traversal in Action OrchestratorEPSS 0.3%CVE-2026-40313CRITICALPraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential PersistenceEPSS 0.3%CVE-2026-40154CRITICALPraisonAI Affected by Untrusted Remote Template Code ExecutionEPSS 0.3%CVE-2026-47407CRITICALPraisonAI Platform has a cross-workspace IDOR + member-role privilege escalationEPSS 0.3%CVE-2026-40315HIGHPraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queriesEPSS 0.3%CVE-2026-47408MEDIUMpraisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownershipEPSS 0.3%CVE-2026-39306HIGHPraisonAI recipe registry pull path traversal writes files outside the chosen output directoryEPSS 0.3%CVE-2026-61441HIGHPraisonAI Platform before 0.1.9 Authorization Bypass via DependenciesEPSS 0.3%CVE-2026-57143HIGHPraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameterEPSS 0.3%CVE-2026-40153HIGHPraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell ToolEPSS 0.3%CVE-2026-40150HIGHPraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl ToolEPSS 0.3%CVE-2026-61429HIGHPraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backendEPSS 0.3%CVE-2026-60086MEDIUMPraisonAI before 4.6.78 Prompt Injection Defense BypassEPSS 0.3%CVE-2026-55537HIGHPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114EPSS 0.3%CVE-2026-57114HIGHPraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingEPSS 0.3%CVE-2026-47413CRITICALpraisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/membersEPSS 0.3%