Vulnerabilidades em mervinpraison
178 resultadosAnálise Vexday
Mervinpraison apresenta perfil de risco mínimo com apenas 1 CVE catalogada na base, sem evidência de exploração ativa (KEV) ou severidade crítica. A vulnerabilidade identificada refere-se a XSS (CWE-79) e não foi publicada nos últimos 90 dias, indicando que não há risco recente imediato associado a este fornecedor.
CVE-2026-55536CRITICALBrowser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)EPSS 0.5%CVE-2025-12019MEDIUMFeatured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-57132HIGHPraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationEPSS 0.5%CVE-2026-55525HIGHPraisonAI: SSRF via redirect-following in praisonaiagents web_crawlEPSS 0.5%CVE-2026-57137HIGHPraisonAI AgentLoop onToolCall approval runs after tool executionEPSS 0.5%CVE-2026-39888CRITICALPraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)EPSS 0.5%CVE-2026-47398HIGHPraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334EPSS 0.5%CVE-2026-47394HIGHPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validateEPSS 0.5%CVE-2026-61444CRITICALPraisonAI before 4.6.78 Code Injection via f-stringEPSS 0.5%CVE-2026-57146HIGHPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by defaultEPSS 0.5%CVE-2026-61435HIGHPraisonAI before 4.6.78 Authentication Bypass via Host Header SpoofingEPSS 0.5%CVE-2026-55528HIGHpraisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)EPSS 0.5%CVE-2026-55533HIGHPraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secretEPSS 0.5%CVE-2026-55527HIGHPraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable locationEPSS 0.5%CVE-2026-55541HIGHPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforcedEPSS 0.5%CVE-2026-55523HIGHPraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targetsEPSS 0.5%CVE-2026-40160HIGHPraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallbackEPSS 0.5%CVE-2026-57130HIGHPraisonAI: IMAP Command Injection via Unsanitized Email Search ParametersEPSS 0.5%CVE-2026-62176CRITICALPraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationEPSS 0.5%CVE-2026-56833HIGHPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversalEPSS 0.5%