Log in Start free

Dokploy

Products

ProductCVEsExploitedLatest
Dokploy59–Oct 25, 2026

Exploited and recent CVEs

  • CVE-2026-116068 High 8.8 Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router 0.3%
  • CVE-2026-111331 Medium 6.3 Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router 0.3%
  • CVE-2026-93425 Critical 9.9 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root 0.6%
  • CVE-2026-86059 Critical 9.6 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one 0.5%
  • CVE-2026-45791 Medium 5.9 Dokploy: Password Change Does Not Revoke Active Sessions 0.4%
  • CVE-2026-45790 High 8.0 Dokploy: Invitation Role Escalation Allows Organization Takeover 0.4%
  • CVE-2026-72902 Critical 9.9 Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById 0.8%
  • CVE-2026-72901 Critical 9.9 Dokploy: Remote Code Execution via volume-backup 1.0%
  • CVE-2026-72886 Critical 9.9 Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632) 0.5%
  • CVE-2026-72885 None 0.0 Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder 0.8%
  • CVE-2026-72884 High 8.7 Dokploy: Command Injection via Compose Custom Command 0.6%
  • CVE-2026-72883 High 8.8 Dokploy: WebSocket Terminal Missing Service-Level Access Control 0.6%
  • CVE-2026-72882 Critical 9.9 Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers 0.5%
  • CVE-2026-72881 Medium 6.4 Dokploy: Command Injection via database credentials in backup/restore commands 0.7%
  • CVE-2026-72880 Critical 9.9 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath` 0.4%
  • CVE-2026-72879 Critical 9.4 Dokploy: Command Injection via Registry Credentials in Swarm Upload 0.5%
  • CVE-2026-72878 Critical 9.6 Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments 0.5%
  • CVE-2026-72877 Critical 9.6 Dokploy: Command Injection via dockerImage in buildRemoteDocker 0.6%
  • CVE-2026-72876 Critical 9.9 Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* 0.7%
  • CVE-2026-72875 High 8.8 Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile 0.8%
  • CVE-2026-72874 High 8.7 Dokploy: Command Injection via Unescaped Git URL in Clone Commands 0.5%
  • CVE-2026-72873 Medium 6.5 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one` 0.5%
  • CVE-2026-72872 Critical 9.9 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone` 0.7%
  • CVE-2026-72871 High 7.5 Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback 0.5%
  • CVE-2026-72870 High 8.7 Dokploy: Command Injection via Docker Credentials in buildRemoteDocker 0.5%
  • CVE-2026-72869 Critical 9.9 Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE 0.7%
  • CVE-2026-72868 Critical 9.9 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection 0.7%
  • CVE-2026-72867 Critical 9.9 Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts) 3.4%
  • CVE-2026-72866 High 8.8 WebSocket Terminal Auth Bypass 0.6%
  • CVE-2026-72865 Critical 9.9 Dokploy: OS Command Injection via compose `composePath` 0.7%