CVE-2019-5736-PoC

Verwendung Der Proof-of-Concept wurde für das Szenario erstellt, in dem das Opfer z.B. docker exec sh ausführt. Vor dem Ausführen des Exploits muss die sh-Binärdatei im Container-Dateisystem überschrieben werden: printf '!/proc/self/exe' /bin/sh Danach, wenn das Opfer den exec-Befehl ausführt,...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: autorizzazione mancante sugli endpoint dei plugin Docker → RCE sull'host Prova di concetto per CVE-2026-44848 , una vulnerabilità di autenticazione mancante CWE-862 in Portainer che consente a un utente non amministratore con accesso all'endpoint Docker di eseguire...

GHSA-647F-G98J-QQ25 vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js process when an embedder-exposed host Promise rejects. This is an incomplete fix for GHSA-m283-3h24-438v: the advisory's capability-bearing rejection rebuild runs only through this...

CVE-2026-93603

vm2 (Node.js sandbox library) through 3.12.0 is vulnerable to a complete sandbox escape due to incorrect handling of a nullish this receiver in the apply trap of its bridge (lib/bridge.js). When sandboxed code invokes a host-provided non-strict (sloppy-mode) function without a receiver (e.g., fn(...

GHSA-9FXX-MV6C-J5XP Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8hr7-r645-pc6w. This link is maintained to preserve external references. Original Description vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor comput...

Exploit for Missing Authorization in Portainer

CVE-2026-44848 — Portainer: Missing Authorization on Docker Pl...

CVE-2026-72869 Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the...

CVE-2026-72736

Summary: CVE-2026-72736 affects Dokploy prior to version 0.29.13. The vulnerability arises because user-supplied values are interpolated into shell commands in the registry credential testing and Docker Swarm cluster management endpoints. There is a safe local code path, but the remote path uses ...

CVE-2026-72882: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed serv...

PT-2026-32326

Summary Device-Paired Node Skips Node Scope Gate → Host RCE.md Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real in shipped v2026.3.28 because a merely device-paired node could expose node commands without node pairing, but high is sufficient given the...

CVE-2017-2615

Quick emulator QEMU built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or...