Dokploy Dokploy

• CVE-2026-116068 High 8.8 Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router 0.3%
• CVE-2026-111331 Medium 6.3 Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router 0.3%
• CVE-2026-93425 Critical 9.9 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root 0.6%
• CVE-2026-86059 Critical 9.6 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one 0.5%
• CVE-2026-45791 Medium 5.9 Dokploy: Password Change Does Not Revoke Active Sessions 0.4%
• CVE-2026-45790 High 8.0 Dokploy: Invitation Role Escalation Allows Organization Takeover 0.4%
• CVE-2026-72902 Critical 9.9 Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById 0.8%
• CVE-2026-72901 Critical 9.9 Dokploy: Remote Code Execution via volume-backup 1.0%
• CVE-2026-72886 Critical 9.9 Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632) 0.5%
• CVE-2026-72885 None 0.0 Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder 0.8%
• CVE-2026-72884 High 8.7 Dokploy: Command Injection via Compose Custom Command 0.6%
• CVE-2026-72883 High 8.8 Dokploy: WebSocket Terminal Missing Service-Level Access Control 0.6%
• CVE-2026-72882 Critical 9.9 Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers 0.5%
• CVE-2026-72881 Medium 6.4 Dokploy: Command Injection via database credentials in backup/restore commands 0.7%
• CVE-2026-72880 Critical 9.9 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath` 0.4%
• CVE-2026-72879 Critical 9.4 Dokploy: Command Injection via Registry Credentials in Swarm Upload 0.5%
• CVE-2026-72878 Critical 9.6 Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments 0.5%
• CVE-2026-72877 Critical 9.6 Dokploy: Command Injection via dockerImage in buildRemoteDocker 0.6%
• CVE-2026-72876 Critical 9.9 Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* 0.7%
• CVE-2026-72875 High 8.8 Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile 0.8%
• CVE-2026-72874 High 8.7 Dokploy: Command Injection via Unescaped Git URL in Clone Commands 0.5%
• CVE-2026-72873 Medium 6.5 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one` 0.5%
• CVE-2026-72872 Critical 9.9 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone` 0.7%
• CVE-2026-72871 High 7.5 Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback 0.5%
• CVE-2026-72870 High 8.7 Dokploy: Command Injection via Docker Credentials in buildRemoteDocker 0.5%
• CVE-2026-72869 Critical 9.9 Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE 0.7%
• CVE-2026-72868 Critical 9.9 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection 0.7%
• CVE-2026-72867 Critical 9.9 Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts) 3.4%
• CVE-2026-72866 High 8.8 WebSocket Terminal Auth Bypass 0.6%
• CVE-2026-72865 Critical 9.9 Dokploy: OS Command Injection via compose `composePath` 0.7%
• CVE-2026-72864 Critical 9.9 Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers) 0.5%
• CVE-2026-72863 Critical 9.9 Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host 0.6%
• CVE-2026-72862 Critical 9.9 Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE 0.6%
• CVE-2026-72740 Critical 9.9 Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan` 0.8%
• CVE-2026-72739 Medium 6.5 Dokploy: Command Injection via Compose Shell Execution 0.6%
• CVE-2026-72738 Critical 9.9 Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter 0.8%
• CVE-2026-72737 Critical 9.6 Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups 0.4%
• CVE-2026-72736 Critical 9.9 Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE 0.6%
• CVE-2026-72735 Critical 9.9 Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution 0.9%
• CVE-2026-72734 High 8.4 Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registration 0.4%
• CVE-2026-72733 Critical 9.9 Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore 0.7%
• CVE-2026-45629 Critical 9.9 Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint 0.9%
• CVE-2026-43917 Medium 5.3 Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation 0.2%
• CVE-2026-45628 Critical 9.6 Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline 0.2%
• CVE-2026-45630 Critical 9.0 Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement 0.9%
• CVE-2026-45631 Critical 10.0 Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret 0.5%
• CVE-2026-45632 Critical 9.9 Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution 0.3%
• CVE-2026-45633 Critical 9.9 Dokploy: Command Injection in /docker-container-logs Endpoint 1.1%
• CVE-2026-45661 Critical 9.9 Dokploy: Remote Code Execution through Path Traversal 0.8%
• CVE-2026-45662 High 8.8 Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion) 1.0%