GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
11 advisories
AGiXT Vulnerable to Path Traversal in safe_join()
High
CVE-2026-39981
was published
for
agixt
(pip)
Apr 8, 2026
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
Critical
CVE-2026-34953
was published
for
praisonai
(pip)
Apr 1, 2026
PraisonAI Has Missing Authentication in WebSocket Gateway
Critical
CVE-2026-34952
was published
for
praisonai
(pip)
Apr 1, 2026
PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
High
CVE-2026-34954
was published
for
praisonaiagents
(pip)
Apr 1, 2026
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
High
CVE-2026-34955
was published
for
praisonai
(pip)
Apr 1, 2026
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
High
CVE-2026-34936
was published
for
praisonai
(pip)
Apr 1, 2026
PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
Moderate
CVE-2026-34939
was published
for
praisonai
(pip)
Apr 1, 2026
PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`
Critical
CVE-2026-34934
was published
for
praisonai
(pip)
Apr 1, 2026
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Critical
CVE-2026-34935
was published
for
praisonai
(pip)
Apr 1, 2026
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
High
CVE-2026-34937
was published
for
praisonaiagents
(pip)
Apr 1, 2026
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
Critical
CVE-2026-34938
was published
for
praisonaiagents
(pip)
Apr 1, 2026
ProTip!
Advisories are also available from the
GraphQL API