PT-2026-69910

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with backup:restore permissions can execute arbitrary commands on the Docker-privileged host. The issue occurs because the backup.restoreBackupWithLogs tRPC subscription passe...

PT-2026-69941

Name of the Vulnerable Software and Affected Versions Cachet versions prior to 2.4.2 Description An issue exists in incident template rendering that allows authenticated users to perform server-side template injection. By creating malicious incident templates using Blade directives or Twig filter...

PT-2026-69924

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.8 Description The getRegistryCommands function in packages/server/src/utils/cluster/upload.ts fails to escape the registry.password and registry.registryUrl variables when interpolating them into a shell command...

PT-2026-69939

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. An authenticated application editor can execute arbitrary commands on the host system. This occurs because the dockerContextPath variable,...

CVE-2026-72876: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and...

PT-2026-69887

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. An authenticated member with service deployment permissions and an attached SSH key can execute arbitrary commands on the host during...

PT-2026-69919

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with application access can execute arbitrary operating system commands on the host. This occurs because the cloneGitRepository function in...

CVE-2026-72867: Improper Input Validation

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

PT-2026-69911

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. The buildRemoteDocker function in packages/server/src/utils/providers/docker.ts interpolates the dockerImage value directly into a docker pull...

CVE-2026-72738: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by childprocess.exec,...

CVE-2026-66738: Improper Control of Generation of Code

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-72879: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...

CVE-2026-71985

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

PT-2026-69295

Name of the Vulnerable Software and Affected Versions lock-upme OPMS versions up to 831440f37a92c1568f2e071d5233bc873a9d8b09 Description A remote SQL injection is possible within the IN Clause Handler component. The issue exists in an unknown function located in the controllers/messages/message.g...

PT-2026-69288

Name of the Vulnerable Software and Affected Versions Tenda CH22 version 1.0.0.1 Description A remote command injection issue exists in the /goform/CertListInfo endpoint. The flaw occurs within the formCertListInfo function when processing the Name argument, allowing an attacker to execute...

CVE-2026-71950

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the actionvalue field, resulting in command execution...

PT-2026-69223

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 software version 1.1.2 C1 202602110044 Description A buffer overflow occurs in the 'app.cgi' interface. A remote attacker can send an excessively long string to the netAcc.addlist.name field to execute...

PT-2026-69231

Name of the Vulnerable Software and Affected Versions MSI Radix AXE6600 version v781521 Description A command injection issue exists in the 'wps.cgi' endpoint. Remote attackers can execute arbitrary commands and obtain root privileges by providing malicious input through the pin2g, pin5g, or pin6...

PT-2026-69195

Name of the Vulnerable Software and Affected Versions adolfosalasgomez3011 slidev-builder-mcp version 2.1.0 Description A command injection flaw exists in the generateAssets Tool within the generateChart function located in the src/tools/generateAssets.ts file. This issue occurs when the outputDi...

PT-2026-69188

Name of the Vulnerable Software and Affected Versions Kirachon context-engine versions prior to 1.9.1 Description Command injection is possible within the review-git-diff Endpoint due to improper handling of the args variable in the execGitCommand function located in the src/mcp/utils/gitUtils.ts...