https://vulnerability.circl.lu/sightings/feed 2026-08-26T19:11:40.448149+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/5c1782a1-423c-45ad-bb8d-5e782c4667e4/export 2026-08-26T19:11:40.465117+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5c1782a1-423c-45ad-bb8d-5e782c4667e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55541", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtx4gsv7ss2f", "content": "CVE-2026-55541 - praisonai\nThe PraisonAI command that should require an API key does not actually check it, leaving the server accessible to anyone. This affects versions from 4.6.34 onward,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #pip #CVE #infosec", "creation_timestamp": "2026-08-26T00:50:04.621517Z"} 2026-08-26T00:50:04.621517+00:00 https://vulnerability.circl.lu/sighting/0d9e744f-cc71-4461-be15-73154aca3249/export 2026-08-26T19:11:40.466711+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "0d9e744f-cc71-4461-be15-73154aca3249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55541", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvxx-r596-f5qj", "content": "", "creation_timestamp": "2026-08-25T16:35:26.278959Z"} 2026-08-25T16:35:26.278959+00:00 https://vulnerability.circl.lu/sighting/9e305432-3698-441e-8252-bd0c16ac7de0/export 2026-08-26T19:11:40.468357+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9e305432-3698-441e-8252-bd0c16ac7de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55541", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mtw4n5te3z2v", "content": "PraisonAI's `praisonai serve agents` and `serve unified` parse `--api-key` but never wire it into the FastAPI app \u2014 no middleware, no header check. CVE-2026-55541, HIGH, confirmed on 4.6.50: the server runs open regardless of the key you set. #dev", "creation_timestamp": "2026-08-25T15:20:58.165186Z"} 2026-08-25T15:20:58.165186+00:00