Filtered by vendor Mervinpraison Subscriptions

Search

Switch to Advanced Search (Beta)
Total 44 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-34952 2 Mervinpraison, Praison 2 Praisonai, Praisonai 2026-04-10 9.1 Critical
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.
CVE-2026-34953 2 Mervinpraison, Praison 2 Praisonai, Praisonai 2026-04-10 9.1 Critical
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. This issue has been patched in version 4.5.97.
CVE-2026-39307 1 Mervinpraison 1 Praisonai 2026-04-09 8.1 High
PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources (e.g., GitHub), the application uses Python's zipfile.extractall() without verifying if the files within the archive resolve outside of the intended extraction directory. This vulnerability is fixed in 1.5.113.
CVE-2026-39891 1 Mervinpraison 1 Praisonai 2026-04-09 8.8 High
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the create_agent_centric_tools() function returns tools (like acp_create_file) that process file content using template rendering. When user input from agent.start() is passed directly into these tools without escaping, template expressions in the input are executed rather than treated as literal text. This vulnerability is fixed in 4.5.115.