CVE-2026-71966 CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

CVE-2026-71966 CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

CVE-2026-72872 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clo...

CVE-2026-72872

CVE-2026-72872 affects Dokploy PaaS prior to version 0.29.13. Affected component: packages/server/src/utils/providers/bitbucket.ts, where bitbucketOwner and bitbucketRepository are stored/used without validation and interpolated into git clone commands executed via execAsync/execAsyncRemote. This...

CVE-2026-72865 Dokploy: OS Command Injection via compose `composePath`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c,...

CVE-2026-72862

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-72862 Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull $dockerImage shell commands on th...

CVE-2026-72862 Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull $dockerImage shell commands on th...

CVE-2026-72740 Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting...

CVE-2026-72740 Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting...

CVE-2026-72736 Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a sa...

CVE-2026-72736

Summary: CVE-2026-72736 affects Dokploy prior to version 0.29.13. The vulnerability arises because user-supplied values are interpolated into shell commands in the registry credential testing and Docker Swarm cluster management endpoints. There is a safe local code path, but the remote path uses ...

CVE-2026-72733 Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

EUVD-2026-55655

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-13206

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026...

CVE-2026-13206

The CVE-2026-13206 entry concerns a high-severity OS command injection in Zyxel Networks WAH7601, due to improper neutralization of special elements in commands. Affected software: WAH7601 (through build 20072026). Impact is described as OS Command Injection with a CVSS v3.1 base score of 9.8 (CR...