CVE-2026-72881

Dokploy (PaaS) is affected before 0.29.13 by a command injection in the backup/restore code paths. The vulnerable components are database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts, which interpolate database na...

CVE-2026-12339

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten...

CVE-2026-72878 Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via childprocess.exec. An...

CVE-2026-72878

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via childprocess.exec. An...

CVE-2026-12339

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-72898 Metabase SQL injection via password reset endpoint

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-66801

A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent a specification for describing event data in a common way message to the shared gh-spec topic. This message can spoof its source as...

CVE-2026-68318

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix use-after-free on workqueue during remove In pdscremove, the workqueue is destroyed before pdscteardown is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdscteardown -...

CVE-2026-68142

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

UBUNTU-CVE-2026-68124

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...

CVE-2026-68318 pds_core: fix use-after-free on workqueue during remove

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix use-after-free on workqueue during remove In pdscremove, the workqueue is destroyed before pdscteardown is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdscteardown -...

EUVD-2026-55419

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix use-after-free on workqueue during remove In pdscremove, the workqueue is destroyed before pdscteardown is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdscteardown -...

CVE-2026-68142

The CVE concerns the Linux kernel geneve driver. A local attacker with CAP_NET_ADMIN in one network namespace can bypass permission checks and modify a geneve network device in a different namespace, potentially enabling unauthorized network configuration changes or disruption. The fix gates the ...

CVE-2026-68142 geneve: require CAP_NET_ADMIN in the device netns for changelink

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

CVE-2026-68127

CVE-2026-68127 describes a Linux kernel flaw in the Identifier-Locator Addressing (ILA) subsystem where a slab-use-after-free can occur during IPv6 packet processing if a transport-header-based path is used. Specifically, ila_csum_adjust_transport() caches ip6h before pskb_may_pull(), and non-lin...

CVE-2026-72578

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Zainul Anwar Adi Putra in WordPress Plugin Church Admin versions = 5.1.1...

CVE-2026-72578 FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

EUVD-2026-55228

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...