Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,894

CVE-2026-72880

Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. This vulnerability is fixed in 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2025-30239

Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Eb210 Pro(eu1) 1.0 Eb210 Pro(us1) 1.0 Eb810v(eu1) V1.0 and 62 more
CVE-2026-72884

Dokploy: Command Injection via Compose Custom Command

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-14615

Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter

A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak
CVE-2026-69114

Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Spacebar Server
Products
Spacebar Server
CVE-2025-4334

Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.

CVSS 3.1 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Najeebmedia
Products
Memberhero
CVE-2024-49604

WordPress Simple User Registration plugin <= 6.7 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Najeeb Ahmad Najeebmedia
Products
Simple User Registration Memberhero
CVE-2026-72879

Dokploy: Command Injection via Registry Credentials in Swarm Upload

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2024-0829

Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorization

The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0. This is due to missing or incorrect capability checks on several ajax actions. This makes it possible for authenticated attackers, with subscriber access or higher, to invoke those actions. As a result, they may modify comment form fields and update plugin settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Najeebmedia
Products
Comments Extra Fields For Post\, Pages And Cpt
CVE-2024-0830

Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgery

The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. As a result, they may modify comment form fields and update plugin settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Najeebmedia
Products
Comments Extra Fields For Post\, Pages And Cpt
CVE-2026-72874

Dokploy: Command Injection via Unescaped Git URL in Clone Commands

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with application access to execute arbitrary operating system commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment. This issue is fixed in version 0.29.13.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-72865

Dokploy: OS Command Injection via compose `composePath`

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-72870

Dokploy: Command Injection via Docker Credentials in buildRemoteDocker

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project access can set a crafted dockerImage through application.update and trigger application.deploy, causing execAsync() to execute arbitrary operating-system commands as the Dokploy server process. This issue is fixed in version 0.29.13.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-72875

Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. This issue is fixed in version 0.29.13.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-72869

Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docker exec, resulting in arbitrary commands running in the Docker-privileged host context. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-72885

Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-72864

Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's role, organization, or service access before passing it to `docker exec`, allowing any authenticated member to obtain a root shell in arbitrary containers on a self-hosted instance. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-69116

FlyEnv < 4.18.0 Cross-Site Scripting via v-html

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Xpf0000
Products
Flyenv
CVE-2026-73035

npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Raineorshine
Products
Npm-check-updates
CVE-2026-34265

Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Netweaver And Abap Platform