How many CVEs have patched update?

5 published CVEs changed update in MervinPraison/PraisonAI, in 3 distinct patches totalling 60 changed lines, between 2026 and 2026.

What is the latest CVE that changed update?

CVE-2026-47412 (praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}), published 2026-07-21, changed lines 82 to 92 of src/praisonai-platform/praisonai_platform/services/agent_service.py.

How does update compare to the rest of MervinPraison/PraisonAI?

MervinPraison/PraisonAI has 29 CVEs with a located fix in total; 5 of them changed update.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

update in MervinPraison/PraisonAI: Patched by 5 CVEs

praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

CVE-2026-47412 · src/praisonai-platform/praisonai_platform/services/agent_service.py · lines 82–92 · +3 −1 in 2 hunks

High · CVSS 8.1

EPSS 0.5%2026-07-21

praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

CVE-2026-47412 · src/praisonai-platform/praisonai_platform/services/issue_service.py · lines 107–118 · +3 −1 in 2 hunks

High · CVSS 8.1

EPSS 0.5%2026-07-21

praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

CVE-2026-47412 · src/praisonai-platform/praisonai_platform/services/project_service.py · lines 72–81 · +3 −1

High · CVSS 8.1

EPSS 0.5%2026-07-21

praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

CVE-2026-47409 · src/praisonai-platform/praisonai_platform/services/agent_service.py · lines 82–92 · +3 −1 in 2 hunks

High · CVSS 8.1

EPSS 0.5%2026-07-21

praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

CVE-2026-47409 · src/praisonai-platform/praisonai_platform/services/issue_service.py · lines 107–118 · +3 −1 in 2 hunks

High · CVSS 8.1

EPSS 0.5%2026-07-21

praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

CVE-2026-47409 · src/praisonai-platform/praisonai_platform/services/project_service.py · lines 72–81 · +3 −1

High · CVSS 8.1

EPSS 0.5%2026-07-21

PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

CVE-2026-47407 · src/praisonai-platform/praisonai_platform/services/agent_service.py · lines 82–92 · +3 −1 in 2 hunks

Critical · CVSS 9.4

EPSS 0.4%2026-07-21

PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

CVE-2026-47407 · src/praisonai-platform/praisonai_platform/services/issue_service.py · lines 107–118 · +3 −1 in 2 hunks

Critical · CVSS 9.4

EPSS 0.4%2026-07-21

PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

CVE-2026-47407 · src/praisonai-platform/praisonai_platform/services/project_service.py · lines 72–81 · +3 −1

Critical · CVSS 9.4

EPSS 0.4%2026-07-21

PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership

CVE-2026-47405 · src/praisonai-platform/praisonai_platform/services/agent_service.py · lines 82–92 · +3 −1 in 2 hunks

High · CVSS 8.8

EPSS 0.5%2026-07-21

PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership

CVE-2026-47405 · src/praisonai-platform/praisonai_platform/services/issue_service.py · lines 107–118 · +3 −1 in 2 hunks

High · CVSS 8.8

EPSS 0.5%2026-07-21

PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership

CVE-2026-47405 · src/praisonai-platform/praisonai_platform/services/project_service.py · lines 72–81 · +3 −1

High · CVSS 8.8

EPSS 0.5%2026-07-21

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

CVE-2026-47399 · src/praisonai-platform/praisonai_platform/services/agent_service.py · lines 82–92 · +3 −1 in 2 hunks

High · CVSS 8.8

EPSS 0.5%2026-07-21

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

CVE-2026-47399 · src/praisonai-platform/praisonai_platform/services/issue_service.py · lines 107–118 · +3 −1 in 2 hunks

High · CVSS 8.8

EPSS 0.5%2026-07-21

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

CVE-2026-47399 · src/praisonai-platform/praisonai_platform/services/project_service.py · lines 72–81 · +3 −1

High · CVSS 8.8

EPSS 0.5%2026-07-21

update

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track MervinPraison/PraisonAI CVEs