CVE-2026-72739

Dokploy: Command Injection via Compose Shell Execution

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72740

Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72899

Metabase SQL injection via public card or dashboard

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Metabase

Products

Metabase

CVE-2026-72900

Metabase information exposure

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Metabase

Products

Metabase

CVE-2026-72876

Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-68171

kernel: Linux kernel (arm64): Security bypass due to stale syscall argument in ptrace and seccomp

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 8.2 High EPSS n/a KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-72881

Dokploy: Command Injection via database credentials in backup/restore commands

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to child_process.exec(). An authenticated administrator with permission to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, exposing database data and credentials and potentially enabling escape when a container is overprivileged. This issue is fixed in version 0.29.13.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72886

Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-48048

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Xwiki

Products

Xwiki-platform

CVE-2026-72723

Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2026-72738

Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72863

Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session but never authorize it. They establish who the user is via validateRequest() and then proceed without consulting the role/permission model that every tRPC procedure enforces. Any authenticated member, can therefore open an interactive shell into any container on the host, including the dokploy container that mounts the Docker socket, and from there obtain root on the host, escaping the application and crossing every tenant boundary. This vulnerability is fixed in 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72866

WebSocket Terminal Auth Bypass

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special serverId=local branch, and obtain an interactive terminal on the Dokploy host without an organization role or server-access check. This issue is fixed in version 0.29.13.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-48120

Kakoune has a Critical RCE via Autorestore Backup Filename Injection

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mawww

Products

Kakoune

CVE-2026-46358

OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Openbao

Products

Openbao

CVE-2026-31404

kernel: NFSD: Defer sub-object cleanup in export put callbacks

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-65819

gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gopacket

Products

Gopacket

CVE-2026-46194

kernel: f2fs: fix node_cnt race between extent node destroy and writeback

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-63872

kernel: esp: fix page frag reference leak on skb_to_sgvec failure

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2021-47504

kernel: io_uring: ensure task_work gets run as part of cancelations

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

Linux

Products

Linux Kernel