CVE-2026-72901

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated...

CVE-2026-72885 Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in...

CVE-2026-72885 Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in...

CVE-2026-44401 Typemill CMS 2.x Persistent XSS via Markdown javascript URI

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdo...

CVE-2026-44401

Typemill CMS 2.x contains a persistent XSS in the Markdown parser extension. Authenticated users with theme-configuration access can inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. The attack leverages javascript: schemes via ParsedownExtension.php or Twig...

CVE-2026-72880

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...

CVE-2026-72880 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...

CVE-2026-72879

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...

CVE-2026-72877 Dokploy: Command Injection via dockerImage in buildRemoteDocker

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

CVE-2026-72874

Dokploy 🚨 CVE-2026-72874: Before version 0.29.13, cloneGitRepository interpolated customGitUrl and customGitBranch into a git clone command sent to execAsync/execAsyncRemote. An authenticated user with application access could trigger deployment to run arbitrary OS commands on the Dokploy host. T...

EUVD-2026-55736

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

CVE-2026-71965 CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public k...

CVE-2026-71964 CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...

EUVD-2026-55734

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...

CVE-2026-72733

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

EUVD-2026-55679

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

EUVD-2026-55667

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1...

CVE-2026-72722 Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extractfrom, TopicLink.ensureentryfor, and TopicLink.duplicatelookup do not consistently enforce Guardian.cansee? checks when processing internal links. An authenticated user can submit...

CVE-2026-72760

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72760 cti-transmute Following List Exposes User Email Addresses to Authenticated Users

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...