288 matches found
CVE-2026-24841
Dokploy (PaaS) has a critical authenticated command-injection in versions prior to 0.26.6 via the WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are interpolated into shell commands without sanitization, enabling an authenticated attacker to execute arbitr...
Dokploy operating system command injection vulnerability
Dokploy is an open-source software developed by Dokploy itself. Versions of Dokploy prior to 0.26.6 contained a vulnerability related to operating system command injection. This vulnerability stemmed from command injection in the WebSocket endpoint/docker-container-terminal, which could allow for...
📄 LibreChat MCP Remote Command Execution
LibreChat's Model Context Protocol MCP implementation contained a remote command execution vulnerability that allowed any authenticated user to execute commands as root on the Docker container. A single API request could trigger the exploit by taking advantage of the exposure of the stdio transpo...
Exploit for Improper Neutralization of Line Delimiters in Cacti
███╗ ███╗ ██████╗ ███╗ ██╗██╗████████╗ ██████╗ ██████╗ █...
EUVD-2020-7373
Malware in sbrugna...
EUVD-2021-1117
Malware in sbrugna...
EUVD-2020-6452
Malware in sbrugna...
EUVD-2017-1256
Malware in sbrugna...
Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
It is an offensive tool for Apache Log4j. This PoC exploit targe...
EUVD-2024-22148
Malicious code in bioql PyPI...
EUVD-2025-6918
Malicious code in bioql PyPI...
EUVD-2024-22150
Malicious code in bioql PyPI...
EUVD-2025-24235
Malicious code in bioql PyPI...
EUVD-2025-7790
Malicious code in bioql PyPI...
EUVD-2024-3054
Malicious code in bioql PyPI...
CVE-2025-34222
Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA/SaaS deployments expose four admin routes – /admin/hp/certupload, /admin/hp/certdelete, /admin/certs/ca, and /admin/certs/serviceclients/scid – without any...
CVE-2025-34222
Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA/SaaS deployments expose four admin routes – /admin/hp/certupload, /admin/hp/certdelete, /admin/certs/ca, and /admin/certs/serviceclients/scid – without any...
CVE-2025-34207 Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration
Vasion Print formerly PrinterLogic Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 VA and SaaS deployments configure the SSH client within Docker instances with the following options: UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These...
Exploit for Code Injection in Langflow
It is an offensive tool for web exploitation. The target product...
Dyad 代码注入漏洞
Dyad is an AI application builder open-sourced by Dyad. A code injection vulnerability exists in Dyad 0.19.0 and earlier versions, which stems from the Preview Window feature that can bypass Docker container protection and could lead to the execution of arbitrary code...