4966 matches found
CVE-2026-24841
Dokploy (PaaS) has a critical authenticated command-injection in versions prior to 0.26.6 via the WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are interpolated into shell commands without sanitization, enabling an authenticated attacker to execute arbitr...
CVE-2026-24841 Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint
Dokploy is a free, self-hostable Platform as a Service PaaS. In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without...
CVE-2026-24841 Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint
Dokploy is a free, self-hostable Platform as a Service PaaS. In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without...
Dokploy operating system command injection vulnerability
Dokploy is an open-source software developed by Dokploy itself. Versions of Dokploy prior to 0.26.6 contained a vulnerability related to operating system command injection. This vulnerability stemmed from command injection in the WebSocket endpoint/docker-container-terminal, which could allow for...
Astra Linux – Vulnerability in openjpeg2
A flaw was discovered in OpenJPEG. Pictures constructed maliciously can cause the program to enter a large loop and continuously print warning messages on the terminal...
@1upmonster/duel (>=0.1.0 <=0.1.8), @flash_trade/magic-trade-client (>=0.1.0 <=1.0.50) +5 more potentially affected by CVE-2026-22696 via @phala/dcap-qvl-web (>=0.2.7 <=0.3.3)
@phala/dcap-qvl-web NPM version =0.2.7, =0.1.0, =0.1.0, =0.3.6, =0.2.9, =0.1.0, =0.4.1 - magic-trade-client =0.2.0 - nearai-cloud-verifier =0.0.1-alpha.1 Source cves: CVE-2026-22696 Source advisory: OSV:GHSA-796P-J2GH-9M2Q...
USN-7978-1: GNU Screen vulnerabilities
It was discovered that GNU Screen incorrectly handled signals when setuid or setgid privileges were being used, which is not the default in Ubuntu. A local attacker could use this issue to send privileged signals, possibly leading to a denial of service. This issue only affected Ubuntu 22.04 LTS...
USN-7978-1 screen vulnerabilities
It was discovered that GNU Screen incorrectly handled signals when setuid or setgid privileges were being used, which is not the default in Ubuntu. A local attacker could use this issue to send privileged signals, possibly leading to a denial of service. This issue only affected Ubuntu 22.04 LTS...
runc: container escape with malicious config due to /dev/console mount and related races
A flaw was found in runc. CVE-2025-52565 is very similar in concept and application toCVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount to /dev/pts/$n, if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount...
runc: container escape with malicious config due to /dev/console mount and related races
A flaw was found in runc. CVE-2025-52565 is very similar in concept and application toCVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount to /dev/pts/$n, if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount...
Azure Linux 3.0 Security Update: util-linux (CVE-2024-28085)
The version of util-linux installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28085 advisory. - wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to...
MiracleLinux 8 : flatpak-1.10.8-1.el8 (AXSA:2023-7197:04)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7197:04 advisory. flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console CVE-2023-28100 flatpak: Metadata with ANSI control codes can...
akasha-plus (>=0.3.0 <=0.3.17), akasha-terminal (>=0.8.0 <=0.8.72) +18 more potentially affected by CVE-2025-15536 via opencc (>=1.1.1 <=1.1.9)
opencc PYPI version =1.1.1, =0.3.0, =0.8.0, =0.1.0, =1.1.0, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2025-15536 Source advisory: SNYK:PYTHON-OPENCC-15874419...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004448)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004448 advisory. A race condition in the Linux kernel before 5.6.2 between the VTDISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free. Tenable has extracted t...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004030)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004030 advisory. A flaw was found in the Linux kernels implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001310)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001310 advisory. Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache ...
MiracleLinux 4 : sudo-1.8.6p3-12.AXS4 (AXSA:2014-027:01)
The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-027:01 advisory. Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while loggin...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002166)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002166 advisory. The ttyopen function in drivers/tty/ttyio.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial of servic...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003559)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003559 advisory. Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache ...