https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T23:57:36.396400+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337845 EUVD-2026-337845 2026-10-14T23:57:36.454984+00:00 EUVD-2026-337845 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61430 fkie_cve-2026-61430 2026-10-14T23:57:36.455020+00:00

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

 https://cve.radiocsirt.org/vuln/ghsa-92x2-g374-gcvx Withdrawn: GHSA-92x2-g374-gcvx — Duplicate Advisory: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure 2026-10-14T23:57:36.455054+00:00

Withdrawn by the publisher.

Affected: PyPI: praisonaiagents

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qg25-6gc4-48mg. This link is maintained to preserve external references.

### Original Description PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.