Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-25 22:59Z
2026-08-10
2026-08-10 20:17Z
CRIT

CVE-2026-72876 — Dokploy: Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72876

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configur CVSSv3.1 9.9 (CRITICAL)

CWECWE 862CWECWE 639CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 20:17Z
HIGH

CVE-2026-72875 — Dokploy: Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72875

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. T CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDDokployTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 20:17Z
HIGH

CVE-2026-71966 — CyberPanel: 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71966

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function. CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDCyberpanelTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 20:17Z
HIGH

CVE-2026-71965 — CyberPanel: 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71965

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system. CVSSv3.1 8.8 (HIGH)

CWECWE 345VNDCyberpanelTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 20:17Z
HIGH

CVE-2026-69118 — Cachet: through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69118

Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achieving remote code execution as the web server process. CVSSv3.1 8.8 (HIGH)

CWECWE 863CWECWE 1336VNDCachetTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 20:17Z
HIGH

CVE-2026-14886 — Vault: Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14886

Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20. CVSSv3.1 8.2 (HIGH)

CWECWE 862VNDVaultTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 19:17Z
CRIT

CVE-2026-72872 — Dokploy: Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72872

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-10
2026-08-10 19:17Z
CRIT

CVE-2026-72869 — Dokploy: Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72869

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docke CVSSv3.1 9.9 (CRITICAL)

CWECWE 77CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 19:17Z
CRIT

CVE-2026-72868 — Dokploy: The `withPermission("destination", "create")` path permits a low-privileged organization member to reach the mutation, close

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72868

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission("destination", "create")` path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, a CVSSv3.1 9.9 (CRITICAL)

CWECWE 862CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 19:17Z
CRIT

CVE-2026-72867 — Dokploy: From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72867

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone comm CVSSv3.1 9.9 (CRITICAL)

CWECWE 20CWECWE 78CWECWE 602VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 19:17Z
HIGH

CVE-2026-72866 — Dokploy: Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72866

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special serverId=local branch, and obtain an interactive terminal on the Dokploy host without an organization role or server-access check. This issue is fixed in version 0.29.13. CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDDokployTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 19:17Z
CRIT

CVE-2026-72865 — Dokploy: Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.t

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72865

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or st CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 19:17Z
CRIT

CVE-2026-72864 — Dokploy: Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72864

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's role, organization, or service access before passing it to `docker exec`, allowing any authenticated member to obtain a root shell in arbitrary containers on a self-hosted instance. CVSSv3.1 9.9 (CRITICAL)

CWECWE 862VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 19:17Z
CRIT

CVE-2026-72863 — Dokploy: Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72863

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session but never authorize it. They establish who the user is via validateRequest() and then proceed without consulting the role/permission model that every tRPC procedure enforces. Any authenticated member, can therefore open an interactive shell into any container on the host, including the dokploy container tha CVSSv3.1 9.9 (CRITICAL)

CWECWE 862CWECWE 269CWECWE 639VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:55Z
INFO

v9.6.0-rc2

BloodHound releases·github.com

BloodHound v9.6.0-rc2 released as a pre-release candidate with a single change: Go dependency bump to version 1.26.5. This is a routine maintenance release with minimal functional changes.

SWBloodhoundTYPTool
28
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72899 — Metabase: allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72899

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDMetabaseTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72898 — Metabase: allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance. CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDMetabaseTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72862 — Dokploy: Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72862

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path. This vulnerability is fixed in 0.29.13. CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72740 — Dokploy: Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72740

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixe CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72738 — Dokploy: Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72738

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13. CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72737 — Dokploy: In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72737

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 a CVSSv3.1 9.6 (CRITICAL)

CWECWE 862CWECWE 639VNDDokployTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72736 — Dokploy: Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72736

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). This vulnerability is fixed in 0 CVSSv3.1 9.9 (CRITICAL)

CWECWE 77VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72735 — Dokploy: Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interp

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72735

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell CVSSv3.1 9.9 (CRITICAL)

CWECWE 77VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
HIGH

CVE-2026-72734 — Dokploy: From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72734

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previous CVSSv3.1 8.4 (HIGH)

CWECWE 639VNDDokployTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72733 — Dokploy: Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72733

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while packages/server/src/utils/restore/postgres.ts and the analogous restore modules in CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score