praison kayıtları
praison üreticisine ait 53 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 9
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')6
- CWE-918 Server-Side Request Forgery (SSRF)6
- CWE-94 Improper Control of Generation of Code ('Code Injection')5
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor3
- CWE-306 Missing Authentication for Critical Function3
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
53 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
40Planlayın | CVE-2026-34938İstismar yok | PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_codepraison · praisonaiagents · CWE-693 | Kritik10,0 | — | %0,8 | 3 Nis 2026 |
40Planlayın | CVE-2026-39305İstismar yok | Arbitrary File Write / Path Traversal in Action Orchestratorpraison · praisonai · CWE-22 | Kritik10,0 | — | %0,4 | 7 Nis 2026 |
40Planlayın | CVE-2026-34955İstismar yok | PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandboxpraison · praisonai · CWE-78 | Kritik10,0 | — | %0,4 | 3 Nis 2026 |
40Planlayın | CVE-2026-40114İstismar yok | PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs APIpraison · praisonai · CWE-918 | Kritik10,0 | — | %0,3 | 9 Nis 2026 |
39İzleyin | CVE-2026-34935İstismar yok | PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()praison · praisonai · CWE-78 | Kritik9,8 | — | %1,0 | 3 Nis 2026 |
39İzleyin | CVE-2026-40288İstismar yok | PraisonAI: Critical RCE via `type: job` workflow YAMLpraison · praisonai · CWE-78 | Kritik9,8 | — | %0,9 | 14 Nis 2026 |
39İzleyin | CVE-2026-39890İstismar yok | PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loadingpraison · praisonai · CWE-502 | Kritik9,8 | — | %0,8 | 8 Nis 2026 |
39İzleyin | CVE-2026-41497İstismar yok | Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAIpraison · praisonai · CWE-77 | Kritik9,8 | — | %0,8 | 8 May 2026 |
39İzleyin | CVE-2026-34937İstismar yok | PraisonAI: Shell Injection in run_python() via Unescaped $() Substitutionpraison · praisonaiagents · CWE-78 | Kritik9,8 | — | %0,6 | 3 Nis 2026 |
39İzleyin | CVE-2026-39888İstismar yok | PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)praison · praisonai · CWE-657 | Kritik9,9 | — | %0,6 | 8 Nis 2026 |
39İzleyin | CVE-2026-34934İstismar yok | PraisonAI: Second-Order SQL Injection in `get_all_user_threads`praison · praisonai · CWE-89 | Kritik9,8 | — | %0,6 | 3 Nis 2026 |
38İzleyin | CVE-2026-40088İstismar yok | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonaipraison · praisonai · CWE-78 | Kritik9,6 | — | %0,6 | 9 Nis 2026 |
38İzleyin | CVE-2026-40154İstismar yok | PraisonAI Affected by Untrusted Remote Template Code Executionpraison · praisonai · CWE-829 | Kritik9,6 | — | %0,5 | 9 Nis 2026 |
37İzleyin | CVE-2026-44336İstismar yok | PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injectionpraison · praisonai · CWE-20 | Kritik9,4 | — | %0,7 | 8 May 2026 |
37İzleyin | CVE-2026-40157İstismar yok | PraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`praison · praisonai · CWE-22 | Kritik9,4 | — | %0,5 | 10 Nis 2026 |
37İzleyin | CVE-2026-40111İstismar yok | PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)praison · praisonaiagents · CWE-78 | Kritik9,3 | — | %0,3 | 9 Nis 2026 |
36İzleyin | CVE-2026-35615İstismar yok | PraisonAI has a Path Traversal in FileToolspraison · praisonai · CWE-22 | Kritik9,2 | — | %0,5 | 7 Nis 2026 |
36İzleyin | CVE-2026-40289İstismar yok | PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessionspraison · praisonai · CWE-306 | Kritik9,1 | — | %0,5 | 14 Nis 2026 |
36İzleyin | CVE-2026-34952İstismar yok | PraisonAI: Missing Authentication in WebSocket Gatewaypraison · praisonai · CWE-306 | Kritik9,1 | — | %0,5 | 3 Nis 2026 |
36İzleyin | CVE-2026-40313İstismar yok | PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistencepraison · praisonai · CWE-829 | Kritik9,1 | — | %0,5 | 14 Nis 2026 |
36İzleyin | CVE-2026-34953İstismar yok | PraisonAI: Authentication Bypass in OAuthManager.validate_token()praison · praisonai · CWE-863 | Kritik9,1 | — | %0,4 | 3 Nis 2026 |
35İzleyin | CVE-2026-39891İstismar yok | PraisonAI has a Template Injection in Agent Tool Definitionspraison · praisonai · CWE-94 | Yüksek8,8 | — | %0,6 | 8 Nis 2026 |
34İzleyin | CVE-2026-44340İstismar yok | PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`praison · praisonai · CWE-22 | Yüksek8,7 | — | %0,5 | 8 May 2026 |
34İzleyin | CVE-2026-44339İstismar yok | PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executepraison · praisonai · CWE-470 | Yüksek8,6 | — | %0,4 | 8 May 2026 |
34İzleyin | CVE-2026-34954İstismar yok | PraisonAI: SSRF in FileTools.download_file() via Unvalidated URLpraison · praisonaiagents · CWE-918 | Yüksek8,6 | — | %0,4 | 3 Nis 2026 |
- CVE-2026-3493840Planlayın
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
KritikCVSS 10,0İstismar yokEPSS %1praison · praisonaiagents3 Nis 2026
- CVE-2026-3930540Planlayın
Arbitrary File Write / Path Traversal in Action Orchestrator
KritikCVSS 10,0İstismar yokEPSS %0praison · praisonai7 Nis 2026
- CVE-2026-3495540Planlayın
PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
KritikCVSS 10,0İstismar yokEPSS %0praison · praisonai3 Nis 2026
- CVE-2026-4011440Planlayın
PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
KritikCVSS 10,0İstismar yokEPSS %0praison · praisonai9 Nis 2026
- CVE-2026-3493539İzleyin
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
KritikCVSS 9,8İstismar yokEPSS %1praison · praisonai3 Nis 2026
- CVE-2026-4028839İzleyin
PraisonAI: Critical RCE via `type: job` workflow YAML
KritikCVSS 9,8İstismar yokEPSS %1praison · praisonai14 Nis 2026
- CVE-2026-3989039İzleyin
PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
KritikCVSS 9,8İstismar yokEPSS %1praison · praisonai8 Nis 2026
- CVE-2026-4149739İzleyin
Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
KritikCVSS 9,8İstismar yokEPSS %1praison · praisonai8 May 2026
- CVE-2026-3493739İzleyin
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
KritikCVSS 9,8İstismar yokEPSS %1praison · praisonaiagents3 Nis 2026
- CVE-2026-3988839İzleyin
PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
KritikCVSS 9,9İstismar yokEPSS %1praison · praisonai8 Nis 2026
- CVE-2026-3493439İzleyin
PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
KritikCVSS 9,8İstismar yokEPSS %1praison · praisonai3 Nis 2026
- CVE-2026-4008838İzleyin
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
KritikCVSS 9,6İstismar yokEPSS %1praison · praisonai9 Nis 2026
- CVE-2026-4015438İzleyin
PraisonAI Affected by Untrusted Remote Template Code Execution
KritikCVSS 9,6İstismar yokEPSS %0praison · praisonai9 Nis 2026
- CVE-2026-4433637İzleyin
PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection
KritikCVSS 9,4İstismar yokEPSS %1praison · praisonai8 May 2026
- CVE-2026-4015737İzleyin
PraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`
KritikCVSS 9,4İstismar yokEPSS %1praison · praisonai10 Nis 2026
- CVE-2026-4011137İzleyin
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
KritikCVSS 9,3İstismar yokEPSS %0praison · praisonaiagents9 Nis 2026
- CVE-2026-3561536İzleyin
PraisonAI has a Path Traversal in FileTools
KritikCVSS 9,2İstismar yokEPSS %1praison · praisonai7 Nis 2026
- CVE-2026-4028936İzleyin
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
KritikCVSS 9,1İstismar yokEPSS %1praison · praisonai14 Nis 2026
- CVE-2026-3495236İzleyin
PraisonAI: Missing Authentication in WebSocket Gateway
KritikCVSS 9,1İstismar yokEPSS %1praison · praisonai3 Nis 2026
- CVE-2026-4031336İzleyin
PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence
KritikCVSS 9,1İstismar yokEPSS %1praison · praisonai14 Nis 2026
- CVE-2026-3495336İzleyin
PraisonAI: Authentication Bypass in OAuthManager.validate_token()
KritikCVSS 9,1İstismar yokEPSS %0praison · praisonai3 Nis 2026
- CVE-2026-3989135İzleyin
PraisonAI has a Template Injection in Agent Tool Definitions
YüksekCVSS 8,8İstismar yokEPSS %1praison · praisonai8 Nis 2026
- CVE-2026-4434034İzleyin
PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
YüksekCVSS 8,7İstismar yokEPSS %0praison · praisonai8 May 2026
- CVE-2026-4433934İzleyin
PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
YüksekCVSS 8,6İstismar yokEPSS %0praison · praisonai8 May 2026
- CVE-2026-3495434İzleyin
PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL
YüksekCVSS 8,6İstismar yokEPSS %0praison · praisonaiagents3 Nis 2026