CVE-2026-57144 is a high-severity vulnerability in MervinPraison's PraisonAI multi-agent teams system affecting versions from 4.5.110 up to but not including 4.6.61. The issue arises when the SandlockSandbox fallback mechanism does not enforce filesystem or network restrictions if the Landlock module is unavailable, allowing sandboxed code to access unauthorized files and network despite restrictions. This vulnerability has been fixed in version 4.6.61.
CVE-2026-57142 is a high-severity OS command injection vulnerability in MervinPraison PraisonAI versions 4.5.87 up to but not including 4.6.61. The vulnerability arises because the recipe execution policy that blocks dangerous tools only checks tools declared in TEMPLATE.yaml, but the actual workflow execution loads tools from workflow.yaml, allowing untrusted recipes to self-approve critical shell tools without explicit permission. This flaw enables unauthorized execution of shell commands. The issue has been fixed in version 4.6.61.
PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.
PraisonAI versions from 4.2.1 up to but not including 4.6.59 have an unauthenticated AgentOS FastAPI deployment surface. This allows unauthorized actors to invoke agent.chat endpoints without authentication, potentially exposing sensitive information and enabling unauthorized agent operations. The issue has been patched in version 4.6.59.
CVE-2026-57114 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in MervinPraison PraisonAI versions 4.5.126 up to but not including 4.6.59. The Async Jobs API validates webhook URLs during job request parsing and again when constructing the internal Job object, blocking loopback/private targets at validation time. However, the actual webhook delivery does not re-validate the hostname, allowing an attacker to exploit DNS resolution changes to bypass SSRF protections. This vulnerability has been fixed in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.
CVE-2026-56840 is a high-severity cross-site scripting (XSS) vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions from 4.5.2 up to but not including 4.6.59 are affected. The vulnerability occurs because the HTTPApproval component renders attacker-controlled input directly into the approval dashboard HTML without proper neutralization. This allows an attacker to inject JavaScript that executes in the context of the dashboard, potentially approving malicious tool requests automatically. The issue has been patched in version 4.6.59.
CVE-2026-56838 is an OS command injection vulnerability in MervinPraison's PraisonAI affecting versions from 4.5.87 up to but not including 4.6.59. The issue arises because the streaming execution path recipe.run_stream() bypasses the dangerous tool policy check that is enforced in the normal recipe.run() path. This allows execution of commands that should be denied unless explicitly allowed, potentially leading to high impact on confidentiality, integrity, and availability. The vulnerability has been patched in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.
CVE-2026-56836 is an improper authentication vulnerability in MervinPraison PraisonAI affecting versions from 4.5.112 up to but not including 4.6.59. The issue arises because the Recipe HTTP server can be started on a non-localhost interface without authentication, allowing unauthenticated access to the recipe API and potentially the /admin/reload endpoint. This vulnerability has been patched in version 4.6.59.
PraisonAI versions from 3.11.0 up to but not including 4.6.59 contain a missing authorization vulnerability in its Slack bot. The bot enforces user and channel restrictions in the normal Slack message event handler but fails to do so in the Slack app_mention event handler. This allows any Slack user who can mention the bot in a channel with the app installed to trigger configured agents despite restrictions, potentially leading to unauthorized actions. The issue is fixed in version 4.6.59.
PraisonAI versions from 3.8.1 up to but not including 4.6.59 contain a path traversal vulnerability in the Dynamic Context Discovery feature. This flaw allows unauthorized reading of arbitrary files on the host filesystem by manipulating artifact tool arguments. The vulnerability arises because the artifact tools do not verify that the supplied paths are within the configured artifact base directory or created by the configured store. This can expose sensitive files such as .env files, cloud credentials, SSH keys, and source code. The issue is fixed in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
PraisonAI versions from 4.5.2 up to but not including 4.6.59 contain a vulnerability in the Discord approval backend where any user able to post in the configured approval channel can approve a pending high-risk tool call by sending a message classified as approval (e.g., 'yes'). This occurs because the system does not verify that the approval message is a direct reply or otherwise bound to the approval request, allowing unthreaded channel cross-talk. The Slack and Telegram approval backends also lack explicit approver allowlist parameters, but the primary issue is with Discord. This vulnerability has been patched in version 4.6.59.
Vvveb CMS versions 1.0.8.6 and earlier contain a path traversal vulnerability in the backup controller's nextRestore() and nextBackup() functions. These functions accept a file parameter that is concatenated to the backup directory path without proper sanitization, allowing an authenticated administrator to read arbitrary files or write SQL dump content to arbitrary locations. This flaw contrasts with other related functions that correctly sanitize file names. The issue has been patched in a subsequent commit.
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.
Aider-AI's aider software up to version 0.86.2 contains an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by committing a malicious .aider.conf.yml configuration file that is auto-loaded without user confirmation. The vulnerability arises because certain configuration values (notifications-command or editor) are executed via subprocess with shell=True, enabling command execution with the victim's privileges after model replies or editor use.
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
CVE-2026-115722 is a vulnerability in the diegonehab rply library up to version 1.1.4 involving improper validation of array indices in the ply_read_header_property() function. This flaw allows crafted PLY files to trigger out-of-bounds accesses in ply_read_list_property(), potentially causing crashes during ASCII parsing or memory corruption during binary parsing.