CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

WS-2019-0262

Tomato, in all versions, is vulnerable to Command Injection. The /api/exec endpoint does not validate user input which allows attackers to run arbitrary commands in the system...

PT-2026-4859

Name of the Vulnerable Software and Affected Versions Dozzle versions prior to 9.0.3 Description A flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters to obtain an interactive root shell in out‑of‑scope containers on the same agent host by directly targeting...

PT-2020-21568

Name of the Vulnerable Software and Affected Versions tomato affected versions not specified Description The issue concerns Command Injection. The /api/exec endpoint does not validate user input, allowing attackers to run arbitrary commands in the system. Recommendations At the moment, there is n...

Command Injection

Overview All versions of tomato are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...