CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,470
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product dokploy:dokploy. Show all products

44 CVEs, showing 1 to 44
CVESeverityTitlePublished
CVE-2026-24839Medium 6.1Dokploy is a free, self-hostable Platform as a Service (PaaS).Jan 28, 2026
CVE-2026-24840High 8.8Dokploy is a free, self-hostable Platform as a Service (PaaS).Jan 28, 2026
CVE-2026-24841Critical 9.9Dokploy is a free, self-hostable Platform as a Service (PaaS).Jan 28, 2026
CVE-2026-72733Critical 9.9Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72734High 8.4Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registration
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72735Critical 9.9Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72736Critical 9.9Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72737Critical 9.6Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72738Critical 9.9Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72739Medium 6.5Dokploy: Command Injection via Compose Shell Execution
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72740Critical 9.9Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72862Critical 9.9Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72863Critical 9.9Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72864Critical 9.9Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72865Critical 9.9Dokploy: OS Command Injection via compose `composePath`
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72866High 8.8WebSocket Terminal Auth Bypass
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72867Critical 9.9Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72868Critical 9.9Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72869Critical 9.9Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72870High 8.7Dokploy: Command Injection via Docker Credentials in buildRemoteDocker
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72871High 7.5Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72872Critical 9.9Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72873Medium 6.5Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72874High 8.7Dokploy: Command Injection via Unescaped Git URL in Clone Commands
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72875High 8.8Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72876Critical 9.9Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72877Critical 9.6Dokploy: Command Injection via dockerImage in buildRemoteDocker
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72878Critical 9.6Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72879Critical 9.4Dokploy: Command Injection via Registry Credentials in Swarm Upload
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72880Critical 9.9Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72881Medium 6.4Dokploy: Command Injection via database credentials in backup/restore commands
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72882Critical 9.9Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72883High 8.8Dokploy: WebSocket Terminal Missing Service-Level Access Control
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72884High 8.7Dokploy: Command Injection via Compose Custom Command
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72885None 0.0Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72886Critical 9.9Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72901Critical 9.9Dokploy: Remote Code Execution via volume-backup
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-72902Critical 9.9Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById
Assigned by GitHub_M
Aug 10, 2026
CVE-2026-45790High 8.0Dokploy: Invitation Role Escalation Allows Organization Takeover
Assigned by GitHub_M
Aug 17, 2026
CVE-2026-45791Medium 5.9Dokploy: Password Change Does Not Revoke Active Sessions
Assigned by GitHub_M
Aug 17, 2026
CVE-2026-82954Critical 9.9Dokploy Settings application.ts writeTraefikConfigInPath path traversal
Assigned by VulDB
Aug 31, 2026
CVE-2026-86059Critical 9.6Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-93425Critical 9.9Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root
Assigned by GitHub_M
Sep 24, 2026
CVE-2026-111331Medium 6.3Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router
Assigned by VulnCheck
Oct 15, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.