Lucene search
+L

11192 matches found

Vulnrichment
Vulnrichment
•added 2026/08/03 1:20 p.m.•16 views

CVE-2026-69096 OpenWrt luci-app-dockerman Read ACL Remote Code Execution

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode dockerrpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

8.8CVSS6.2AI score0.0327EPSS
SaveExploits0References4
BDU FSTEC
BDU FSTEC
•added 2026/08/03 12:00 a.m.•12 views

The vulnerability of the vllm-metal inference backend component of the Docker Desktop Docker Model Runner plugin allows a attacker to execute arbitrary code.

The vulnerability of the vllm-metal inference backend component of the Docker Desktop Docker Model Runner plugin is related to the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a attacker to execute arbitrary code...

8.6CVSS5.9AI score0.00184EPSS
SaveExploits1References2Affected Software1
Positive Technologies
Positive Technologies
•added 2026/08/03 12:00 a.m.•35 views

PT-2026-67418

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

8.8CVSS6.2AI score0.0327EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
•added 2026/08/03 12:00 a.m.•16 views

Fedora 45 : docker-buildkit (2026-26c0a0ee30)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-26c0a0ee30 advisory. Automatic update for docker-buildkit-0.32.1-1.fc45. Changelog Mon Aug 3 2026 Bradley G Smith - 0.32.1-1 - Update to release v0.32.1 - Upstream fixes...

9.6CVSS7.8AI score0.00353EPSS
SaveExploits0References3
VulnCheck KEV
VulnCheck KEV
•added 2026/08/01 12:00 a.m.•28 views

VulnCheck KEV: CVE-2026-53576

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

10CVSS5.3AI score0.03296EPSS
SaveIn wildExploits4References24
NVD
NVD
•added 2026/07/31 5:16 p.m.•22 views

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS0.00506EPSS
SaveExploits0References3
GithubExploit
GithubExploit
•added 2026/07/31 4:51 p.m.•69 views

Exploit for CVE-2026-66066

KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...

9.5CVSS6.1AI score0.02099EPSS
SaveExploits10
NVD
NVD
•added 2026/07/31 4:16 p.m.•21 views

CVE-2026-16503

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

9.1CVSS0.00429EPSS
SaveExploits0References1
OSV
OSV
•added 2026/07/31 4:16 p.m.•13 views

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS5.5AI score
SaveExploits0References5
CVE
CVE
•added 2026/07/31 4:16 p.m.•88 views

CVE-2026-52855

Wings (Pterodactyl server control plane) contains a vulnerability in egg configuration-file templating prior to v1.12.3: {{config.}} placeholders can reveal sensitive daemon config values ({{config.token}}, {{config.token_id}}, {{config.docker.registries}}) to a low-privilege user. The issue aris...

9.9CVSS5.5AI score0.00506EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/07/31 4:16 p.m.•50 views

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS0.00506EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/07/31 3:18 p.m.•21 views

EUVD-2026-51547

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

5.5AI score0.00429EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/07/31 3:18 p.m.•48 views

CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

0.00429EPSS
SaveExploits0References1
CVE
CVE
•added 2026/07/31 3:18 p.m.•69 views

CVE-2026-16503

The VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432 ) using the default password "postgres" . Because Docker manages its own iptables rules, this configuration bypasses standard host UFW firewall protections. A remote attacker ca...

9.1CVSS5.5AI score0.00429EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/31 12:00 a.m.•1 views

CVE-2026-16503: Initialization of a Resource with an Insecure Default

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

9.1CVSS5.8AI score0.00429EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/07/31 12:00 a.m.•29 views

PT-2026-66762

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

5.5AI score0.00429EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/31 12:00 a.m.•30 views

PT-2026-66782

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.token id, and config.docker.registries from the full daemon...

9.9CVSS5.5AI score0.00506EPSS
SaveExploits0References4
NVD
NVD
•added 2026/07/30 8:18 p.m.•19 views

CVE-2026-67208

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...

9.8CVSS0.04265EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/07/30 7:17 p.m.•39 views

CVE-2026-67208 Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...

9.8CVSS0.04265EPSS
SaveExploits0References2
CVE
CVE
•added 2026/07/30 7:17 p.m.•60 views

CVE-2026-67208

CVE-2026-67208 – Juggle 1.6.0 exposes an unauthenticated remote code execution via the exposed H2 database web console. An attacker can reach the unprotected /h2-console endpoint, authenticate with default shipped credentials, and use the H2 CREATE ALIAS Runtime.exec() technique to execute arbitr...

9.8CVSS6.7AI score0.04265EPSS
SaveExploits0References2
Rows per page
Query Builder