https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-44339.htmlhttps://patchthecve.com/cve/CVE-2026-44339.htmlMon, 26 Oct 2026 18:10:00 +0000HIGH 8.6: PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _pehttps://patchthecve.com/cve/CVE-2026-44335.htmlhttps://patchthecve.com/cve/CVE-2026-44335.htmlMon, 26 Oct 2026 18:10:00 +0000CRITICAL 9.8: PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32.https://patchthecve.com/cve/CVE-2026-41496.htmlhttps://patchthecve.com/cve/CVE-2026-41496.htmlMon, 26 Oct 2026 19:10:00 +0000HIGH 8.1: PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, Surrhttps://patchthecve.com/cve/CVE-2026-40160.htmlhttps://patchthecve.com/cve/CVE-2026-40160.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.5: PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169https://patchthecve.com/cve/CVE-2026-40153.htmlhttps://patchthecve.com/cve/CVE-2026-40153.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.4: PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This https://patchthecve.com/cve/CVE-2026-40150.htmlhttps://patchthecve.com/cve/CVE-2026-40150.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.7: PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. T