Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.
Depth = severity + exploitation
CVE-2026-60091High· 7.2PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
CVE-2026-60085HighPraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
CVE-2026-61427High· 7.3PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
CVE-2026-61434High· 8.8PraisonAI: Shell command allowlist bypass via find -exec built-in action
CVE-2026-61435High· 8.2PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
CVE-2026-61433High· 7.8PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
CVE-2026-60086Medium· 5.3PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked
CVE-2026-61431Medium· 5.5PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace
CVE-2026-61436High· 8.6PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
CVE-2026-55529Medium· 6.9PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
CVE-2026-55531Medium· 6.5PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
CVE-2026-55534High· 8.6PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
CVE-2026-55540High· 7.1PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
CVE-2026-55538High· 7.3PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
CVE-2026-55537High· 7.1PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
CVE-2026-55535Medium· 6.8PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
CVE-2026-55541HighPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
CVE-2026-55539High· 8.6PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
CVE-2026-55533High· 8.2PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
CVE-2026-55532High· 7.6PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
CVE-2026-55536Critical· 9.1PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
GHSA-65c8-r727-2mpjHigh· 7.5Duplicate Advisory: PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
GHSA-5866-9272-qcfvMedium· 7.3Duplicate Advisory: PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
GHSA-qpq9-hwx9-cwgcHigh· 7.8Duplicate Advisory: PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
GHSA-gp65-m7q3-4vjwHigh· 8.2Duplicate Advisory: PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
The beta is over. VulnSea now runs at vulnsea.com, every old beta link redirects to the same page, and your account, API keys and watchlists came with it. Plus a round of hardening, faster pages, and new request limits agents should know about.
A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.
A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.