CVE-2026-69096 OpenWrt luci-app-dockerman Read ACL Remote Code Execution

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode dockerrpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

The vulnerability of the vllm-metal inference backend component of the Docker Desktop Docker Model Runner plugin allows a attacker to execute arbitrary code.

The vulnerability of the vllm-metal inference backend component of the Docker Desktop Docker Model Runner plugin is related to the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a attacker to execute arbitrary code...

PT-2026-67418

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

Fedora 45 : docker-buildkit (2026-26c0a0ee30)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-26c0a0ee30 advisory. Automatic update for docker-buildkit-0.32.1-1.fc45. Changelog Mon Aug 3 2026 Bradley G Smith - 0.32.1-1 - Update to release v0.32.1 - Upstream fixes...

VulnCheck KEV: CVE-2026-53576

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

Exploit for CVE-2026-66066

KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...

CVE-2026-16503

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52855

Wings (Pterodactyl server control plane) contains a vulnerability in egg configuration-file templating prior to v1.12.3: {{config.}} placeholders can reveal sensitive daemon config values ({{config.token}}, {{config.token_id}}, {{config.docker.registries}}) to a low-privilege user. The issue aris...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

EUVD-2026-51547

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16503

The VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432 ) using the default password "postgres" . Because Docker manages its own iptables rules, this configuration bypasses standard host UFW firewall protections. A remote attacker ca...

CVE-2026-16503: Initialization of a Resource with an Insecure Default

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

PT-2026-66762

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

PT-2026-66782

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.token id, and config.docker.registries from the full daemon...

CVE-2026-67208

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...

CVE-2026-67208 Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...

CVE-2026-67208

CVE-2026-67208 – Juggle 1.6.0 exposes an unauthenticated remote code execution via the exposed H2 database web console. An attacker can reach the unprotected /h2-console endpoint, authenticate with default shipped credentials, and use the H2 CREATE ALIAS Runtime.exec() technique to execute arbitr...