CVE-2026-72739 Dokploy: Command Injection via Compose Shell Execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the createCommand function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed,...

CVE-2026-72739

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the createCommand function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed,...

EUVD-2026-55684

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a sa...

CVE-2026-72735 Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

CVE-2026-72735 Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

CVE-2026-72735

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

CVE-2026-72735 Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

EUVD-2026-55681

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

CVE-2026-72733

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

SUSE CVE-2026-48120

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...

CVE-2026-18412 The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

CVE-2026-18412

The OpenCart e-commerce platform (specifically version 4.2.0.0 ) contains a directory traversal vulnerability in its extension installer. The installer extracts uploaded .ocmod.zip files but fails to validate that the extracted paths remain within the intended directory. An attacker can exploit t...

EUVD-2026-55652

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

CVE-2026-68276

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

EUVD-2026-55377

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

CVE-2026-72580

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

SummaryThe AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

EUVD-2026-55217

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...