Security advisories

medium2026-06-01

CVE-2026-10224-hermes-agent has an Uncontrolled Resource Consumption issue

nousresearch/hermes-agent · GHSA-pmqc-57g8-c22c

low2026-06-01

CVE-2026-10223-hermes-agent has an Injection issue

nousresearch/hermes-agent · GHSA-33qv-c5qm-799v

medium2026-06-01

CVE-2026-10221-hermes-agent has an Injection issue

nousresearch/hermes-agent · GHSA-xq8w-9jvx-gm3v

low2026-06-01

CVE-2026-10222-hermes-agent has an Injection issue

nousresearch/hermes-agent · GHSA-mv8x-fg99-32mf

medium2026-06-01

CVE-2026-10219-GoClaw has a Command Injection issue

nextlevelbuilder/goclaw · GHSA-6jm8-4fhr-5w64

low2026-06-01

CVE-2026-10212-AstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass

astrbotdevs/astrbot · GHSA-r6vm-4xwg-w69h

low2026-06-01

CVE-2026-10215-Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API

dolibarr/dolibarr · GHSA-7fg5-vc77-69fp

low2026-05-31

CVE-2026-10177-Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

aider-ai/aider · GHSA-hchg-qm84-cj9p

low2026-05-31

CVE-2026-10175-Aider is vulnerable to Code Injection via editor_coder.run function

aider-ai/aider · GHSA-7w7m-v5vp-w699

critical2026-05-29

CVE-2026-47416-praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}

mervinpraison/praisonai · GHSA-c2m8-4gcg-v22g

high2026-05-29

CVE-2026-47409-praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role

mervinpraison/praisonai · GHSA-w388-2392-px73

high2026-05-29

CVE-2026-47414-praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)

mervinpraison/praisonai · GHSA-5jx9-w35f-vp65

high2026-05-29

CVE-2026-47406-praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks

mervinpraison/praisonai · GHSA-4x6r-9v57-3gqw

critical2026-05-29

CVE-2026-47410-praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

mervinpraison/praisonai · GHSA-3qg8-5g3r-79v5

high2026-05-29

CVE-2026-47405-PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership

mervinpraison/praisonai · GHSA-h37g-4h4p-9x97

high2026-05-29

CVE-2026-47399-PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

mervinpraison/praisonai · GHSA-6h6v-6m7w-7vxx

critical2026-05-29

CVE-2026-47407-PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

mervinpraison/praisonai · GHSA-h8q5-cp56-rr65

medium2026-05-29

CVE-2026-47408-praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

mervinpraison/praisonai · GHSA-27p4-pjqv-whgj

high2026-05-29

CVE-2026-48169-PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API

mervinpraison/praisonai · GHSA-gv23-xrm3-8c62

high2026-05-29

CVE-2026-47397-PraisonAI has an Arbitrary File Write in Python API

mervinpraison/praisonai · GHSA-hvhp-v2gc-268q