CVE-2026-72720

Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2026-72871

Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72724

Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2026-72726

Discourse: Unauthorized eavesdropping on private AI bot conversations.

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2026-72728

Discourse: Onebox iframe origin allowlist enforces URL authority boundary

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2026-72730

Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2026-72734

Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registration

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72735

Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72736

Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). This vulnerability is fixed in 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72739

Dokploy: Command Injection via Compose Shell Execution

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72740

Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72899

Metabase SQL injection via public card or dashboard

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Metabase

Products

Metabase

CVE-2026-72900

Metabase information exposure

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Metabase

Products

Metabase

CVE-2026-72876

Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-68171

kernel: Linux kernel (arm64): Security bypass due to stale syscall argument in ptrace and seccomp

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 8.2 High EPSS n/a KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-72881

Dokploy: Command Injection via database credentials in backup/restore commands

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to child_process.exec(). An authenticated administrator with permission to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, exposing database data and credentials and potentially enabling escape when a container is overprivileged. This issue is fixed in version 0.29.13.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-72886

Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-48048

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Xwiki

Products

Xwiki-platform

CVE-2026-72723

Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2026-72738

Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy