PT-2026-97912

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated organization member with service:read permission can execute arbitrary commands as root within the Dokploy container. The issue occurs because the patch.readRepoDirectories tRPC...

PT-2026-95973

Name of the Vulnerable Software and Affected Versions 0-Gaurav-0 nexus-mcp affected versions not specified Description Command injection is possible in the nexus reauth MCP tool within the file src/auth/browser.ts. The issue occurs when the url argument is passed to the child process.exec functio...

PT-2026-69923

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description The backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c and sh -c strings, which are then executed via the child process.exe...

PT-2026-69883

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with backup:read permission can execute arbitrary commands on the host. This occurs because the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup....

PT-2026-8318

Name of the Vulnerable Software and Affected Versions yued-fe LuLu UI versions up to 3.0.0 Description A security flaw exists in yued-fe LuLu UI, specifically in the child process.exec function within the run.js file. This allows for operating system command injection, and the attack can be...

PT-2019-12633

Name of the Vulnerable Software and Affected Versions Gridea version 0.8.0 Description The issue allows for arbitrary code execution through an XSS vulnerability. This can be achieved by calling the Nodejs module, as demonstrated by the use of child process.exec and the substring img src=...