CVE-2026-18621

A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...

CVE-2026-18621

CVE-2026-18621 affects Data Science Pipelines (DSP). A flaw allows a user with namespace editor privileges to bypass hardening by submitting a malicious Argo Workflow via the V1 API path, enabling the API server to create pods with elevated privileges (a confused-deputy scenario). Successful expl...

CVE-2026-18621 Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...

EUVD-2026-55814

A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...

CVE-2026-18621 Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...

CVE-2026-72883

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validat...

CVE-2026-72886 Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch...

CVE-2026-72886 Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch...

CVE-2025-13293 Backdoor / default root credentials

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...

CVE-2025-13293

The affected product is TBEA TLogger with version 2.1.0.0B0.0.0.0. A hard-coded/default root credential allows an unauthenticated remote attacker to gain root access via the exposed SSH service. The root password can be recovered from the hash in /etc/shadow and used to authenticate to SSH, yield...

EUVD-2025-210666

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...

EUVD-2026-55735

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public k...

CVE-2026-71965 CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public k...

CVE-2026-71965

CyberPanel 2.4.3 contains an authenticated remote code execution vulnerability in the remote backup feature. An authenticated attacker can abuse unverified SSH public key retrieval to write a malicious key to /root/.ssh/authorized_keys, gaining root SSH access. The flaw is fixed in commit eca0c3c...

CVE-2026-72863

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...

CVE-2026-72863 Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...

CVE-2026-72863

Dokploy before 0.29.13 has a missing authorization check in WebSocket handlers (in-app terminals and log streamers) that authenticate a session but do not enforce role-based access. Any authenticated user can open an interactive shell into any container on the host (including the Dokploy containe...

CVE-2026-72863 Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...

Exploit for CVE-2026-64824

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Pa...

CVE-2026-72567

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...