CVE-2026-72864

CVE-2026-72864 affects Dokploy (= 0.29.13 or apply vendor-provided fixes. If present, references include Dokploy advisories and release notes.

CVE-2026-72862

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull $dockerImage shell commands on th...

CVE-2026-72740

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting...

CVE-2026-72862

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull $dockerImage shell commands on th...

CVE-2026-72740

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting...

EUVD-2026-55689

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting...

CVE-2026-72740 Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting...

CVE-2026-72739 Dokploy: Command Injection via Compose Shell Execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the createCommand function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed,...

CVE-2026-72739

Dokploy prior to version 0.29.13 is affected by a command injection in createCommand() where shell commands are built by interpolating compose service names and configuration into bash command strings. A maliciously crafted name or service definition can cause shell metacharacters to be treated a...

CVE-2026-72739 Dokploy: Command Injection via Compose Shell Execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the createCommand function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed,...

CVE-2026-72739

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the createCommand function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed,...

CVE-2026-72735 Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

CVE-2026-72735

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

CVE-2026-72733

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

CVE-2026-18412

The CVE-2026-18412 vulnerability affects OpenCart v4.2.0.0 extensions installation. The extension installer extracts uploaded zip files (with .ocmod.zip) and does not validate that extracted paths remain inside the target directory, enabling a directory traversal via sequences like “../”. An atta...

EUVD-2026-55652

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

CVE-2026-68276

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

EUVD-2026-55377

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...