Vulnerabilidades em mervinpraison
178 resultadosAnálise Vexday
Mervinpraison apresenta perfil de risco mínimo com apenas 1 CVE catalogada na base, sem evidência de exploração ativa (KEV) ou severidade crítica. A vulnerabilidade identificada refere-se a XSS (CWE-79) e não foi publicada nos últimos 90 dias, indicando que não há risco recente imediato associado a este fornecedor.
CVE-2026-34954HIGHPraisonAI: SSRF in FileTools.download_file() via Unvalidated URLEPSS 0.4%CVE-2026-47418HIGHpraisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOREPSS 0.4%CVE-2026-47406HIGHpraisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace issue linking + read + delete IDOREPSS 0.4%CVE-2026-57113HIGHPraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletionEPSS 0.4%CVE-2026-61426HIGHPraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure DefaultsEPSS 0.4%CVE-2026-40152MEDIUMPraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace BoundaryEPSS 0.4%CVE-2026-55540HIGHPraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinksEPSS 0.4%CVE-2026-34955HIGHPraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandboxEPSS 0.4%CVE-2026-34953CRITICALPraisonAI: Authentication Bypass in OAuthManager.validate_token()EPSS 0.4%CVE-2026-61436HIGHPraisonAI before 4.6.78 Missing Webhook Signature VerificationEPSS 0.4%CVE-2026-47415HIGHpraisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOREPSS 0.4%CVE-2026-47414HIGHpraisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOREPSS 0.4%CVE-2026-44335HIGHSSRF bypass in PraisonAIEPSS 0.4%CVE-2026-56839HIGHPraisonAI Code agent tools fail open without a workspace boundaryEPSS 0.4%CVE-2026-57126HIGHpraisonaiagents: SSRF guard validates literal IPs only and never resolves DNSEPSS 0.4%CVE-2026-40157CRITICALPraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`EPSS 0.4%CVE-2026-56840HIGHPraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous toolsEPSS 0.4%CVE-2026-56834HIGHPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storageEPSS 0.4%CVE-2026-61431MEDIUMPraisonAI before 4.6.78 Path Traversal via ContextGathererEPSS 0.4%CVE-2026-40116HIGHPraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate LimitsEPSS 0.4%