M
Vendor security profile
MervinPraison
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs54
Critical16
CISA KEV0
Public exploit41
Patch rate%39
Avg. CVSS8.3
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
22
28
4
CVE KEV
CVE severity distribution
54toplam CVE
Critical16 (30%)
High30 (56%)
Medium8 (15%)
Patch and exploitation view
%39
Verified patch
%0
CISA KEV
%76
Public exploit
21Patch available
0Partial
0Workaround
0Vendor: no patch
33Unknown
Latest vulnerabilities
9.8
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
M
Patch status unknown
8.8
CVE-2026-57143
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
M
Patch status unknown
9.1
CVE-2026-62176
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
M
Patch status unknownEPSS %0
6.5
CVE-2026-62179
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
M
Patch status unknownEPSS %0
9.8
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
M
Patch status unknownEPSS %1
9.8
CVE-2026-57148
praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
M
Patch status unknownEPSS %1
9.4
CVE-2026-57140
PraisonAI AgentOS exposes unauthenticated agent listing and invocation
M
Patch status unknownEPSS %1
9.8
CVE-2026-57139
PraisonAI MCPServer exposes unauthenticated HTTP tools/call
M
Patch status unknownEPSS %1
8.8
CVE-2026-57133
PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
M
Patch status unknownEPSS %1
7.6
CVE-2026-57135
PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
M
Patch status unknownEPSS %0