11689 matches found
CVE-2026-18948
Feast: A flaw in serializing UDFs with dill enabling unsafe deserialization leads to unauthenticated RCE on the feature server and, via deserialization bypass, on the registry server. A remote attacker can store a malicious UDF, with the risk of cross-tenant data access and lateral movement in de...
CVE-2026-18948
A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...
CVE-2026-18941 Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication
A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...
CVE-2026-18941
A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...
CVE-2026-72882
Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed serv...
Exploit for Code Injection in Pgadmin Pgadmin_4
No d...
CVE-2026-72902 Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...
CVE-2026-72902
Dokploy (PaaS) vulnerability CVE-2026-72902 affects version prior to 0.29.13. An authenticated user can run arbitrary commands on a local/SSH target because registry.ts interpolates the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This is fixed in ...
CVE-2026-72901 Dokploy: Remote Code Execution via volume-backup
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated...
CVE-2026-72882
Dokploy: CVE-2026-72882 affects Dokploy 0.28.8 and earlier. An authenticated user who can create or update file mounts can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment...
CVE-2026-72870
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the buildRemoteDocker function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project...
CVE-2026-72877 Dokploy: Command Injection via dockerImage in buildRemoteDocker
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...
CVE-2026-71965
CyberPanel 2.4.3 contains an authenticated remote code execution vulnerability in the remote backup feature. An authenticated attacker can abuse unverified SSH public key retrieval to write a malicious key to /root/.ssh/authorized_keys, gaining root SSH access. The flaw is fixed in commit eca0c3c...
CVE-2026-72869
Dokploy (PaaS) contains an authenticated OS command injection in backup.restoreBackupWithLogs. Before v0.29.13, the tRPC backup.restoreBackupWithLogs path passes the databaseName into nested shell text executed by Node.js exec, allowing a user with backup:restore permission to craft a databaseNam...
CVE-2026-72869 Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the...
CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...
CVE-2026-72868
Dokploy prior to v0.29.13 is vulnerable: destination.testConnection fields are interpolated into an rclone ls command executed via child_process.exec, enabling a low-privileged member with destination:create permission to craft arguments and execute arbitrary commands in the Dokploy container, wh...
CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...
CVE-2026-72862 Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull $dockerImage shell commands on th...