High
CVE-2026-40114
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,343
Reset filters
Medium
CVE-2026-40152
PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary
Medium
CVE-2026-40117
PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate
High
CVE-2026-40150
PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool
Medium
CVE-2026-40151
PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
Medium
CVE-2026-40148
PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits
Medium
CVE-2026-40115
PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS
High
CVE-2026-40156
PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
Medium
CVE-2026-56078
PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling
High
CVE-2026-40116
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
High
CVE-2026-39891
PraisonAI has Template Injection in Agent Tool Definitions
Medium
CVE-2026-40112
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
High
CVE-2026-39889
PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server
High
CVE-2026-39308
PraisonAI recipe registry publish path traversal allows out-of-root file write
Medium
CVE-2026-33753
rfc3161-client Has Improper Certificate Validation
High
CVE-2026-34589
OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write
High
CVE-2026-34588
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
High
CVE-2026-34444
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
High
CVE-2026-39306
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
High
CVE-2026-39307
PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction
High
CVE-2026-35464
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
Medium
CVE-2026-26981
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
Medium
CVE-2025-64183
OpenEXR has use after free in PyObject_StealAttrString
Low
CVE-2025-64181
OpenEXR Makes Use of Uninitialized Memory
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.