agentprime: dokployEvery new CVE for dokploy.https://agentprime.io/CVE-2026-116068: Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Routerhttps://agentprime.io/advisories/CVE-2026-116068/https://agentprime.io/advisories/CVE-2026-116068/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 11:50:57 GMTCVECVE-2026-111331: Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Routerhttps://agentprime.io/advisories/CVE-2026-111331/https://agentprime.io/advisories/CVE-2026-111331/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 21:43:34 GMTCVECVE-2026-93425: Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as roothttps://agentprime.io/advisories/CVE-2026-93425/https://agentprime.io/advisories/CVE-2026-93425/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 15:45:46 GMTCVEcriticalCVE-2026-86059: Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.onehttps://agentprime.io/advisories/CVE-2026-86059/https://agentprime.io/advisories/CVE-2026-86059/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 16:11:56 GMTCVEcriticalCVE-2026-82954: Dokploy Settings application.ts writeTraefikConfigInPath path traversalhttps://agentprime.io/advisories/CVE-2026-82954/https://agentprime.io/advisories/CVE-2026-82954/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 21:45:06 GMTCVEcriticalCVE-2026-45791: Dokploy: Password Change Does Not Revoke Active Sessionshttps://agentprime.io/advisories/CVE-2026-45791/https://agentprime.io/advisories/CVE-2026-45791/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 21:25:53 GMTCVECVE-2026-45790: Dokploy: Invitation Role Escalation Allows Organization Takeoverhttps://agentprime.io/advisories/CVE-2026-45790/https://agentprime.io/advisories/CVE-2026-45790/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 21:24:22 GMTCVECVE-2026-72902: Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryByIdhttps://agentprime.io/advisories/CVE-2026-72902/https://agentprime.io/advisories/CVE-2026-72902/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:41:40 GMTCVEcriticalCVE-2026-72901: Dokploy: Remote Code Execution via volume-backuphttps://agentprime.io/advisories/CVE-2026-72901/https://agentprime.io/advisories/CVE-2026-72901/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:40:15 GMTCVEcriticalCVE-2026-72886: Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)https://agentprime.io/advisories/CVE-2026-72886/https://agentprime.io/advisories/CVE-2026-72886/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:38:24 GMTCVEcriticalCVE-2026-72885: Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builderhttps://agentprime.io/advisories/CVE-2026-72885/https://agentprime.io/advisories/CVE-2026-72885/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:31:36 GMTCVECVE-2026-72884: Dokploy: Command Injection via Compose Custom Commandhttps://agentprime.io/advisories/CVE-2026-72884/https://agentprime.io/advisories/CVE-2026-72884/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:30:07 GMTCVECVE-2026-72883: Dokploy: WebSocket Terminal Missing Service-Level Access Controlhttps://agentprime.io/advisories/CVE-2026-72883/https://agentprime.io/advisories/CVE-2026-72883/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:28:45 GMTCVECVE-2026-72882: Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servershttps://agentprime.io/advisories/CVE-2026-72882/https://agentprime.io/advisories/CVE-2026-72882/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:27:09 GMTCVEcriticalCVE-2026-72881: Dokploy: Command Injection via database credentials in backup/restore commandshttps://agentprime.io/advisories/CVE-2026-72881/https://agentprime.io/advisories/CVE-2026-72881/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:21:05 GMTCVECVE-2026-72880: Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`https://agentprime.io/advisories/CVE-2026-72880/https://agentprime.io/advisories/CVE-2026-72880/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:19:39 GMTCVEcriticalCVE-2026-72879: Dokploy: Command Injection via Registry Credentials in Swarm Uploadhttps://agentprime.io/advisories/CVE-2026-72879/https://agentprime.io/advisories/CVE-2026-72879/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:14:52 GMTCVEcriticalCVE-2026-72878: Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell argumentshttps://agentprime.io/advisories/CVE-2026-72878/https://agentprime.io/advisories/CVE-2026-72878/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:11:39 GMTCVEcriticalCVE-2026-72877: Dokploy: Command Injection via dockerImage in buildRemoteDockerhttps://agentprime.io/advisories/CVE-2026-72877/https://agentprime.io/advisories/CVE-2026-72877/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:02:28 GMTCVEcriticalCVE-2026-72876: Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*https://agentprime.io/advisories/CVE-2026-72876/https://agentprime.io/advisories/CVE-2026-72876/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 19:00:54 GMTCVEcriticalCVE-2026-72875: Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFilehttps://agentprime.io/advisories/CVE-2026-72875/https://agentprime.io/advisories/CVE-2026-72875/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:59:33 GMTCVECVE-2026-72874: Dokploy: Command Injection via Unescaped Git URL in Clone Commandshttps://agentprime.io/advisories/CVE-2026-72874/https://agentprime.io/advisories/CVE-2026-72874/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:57:40 GMTCVECVE-2026-72873: Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`https://agentprime.io/advisories/CVE-2026-72873/https://agentprime.io/advisories/CVE-2026-72873/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:56:14 GMTCVECVE-2026-72872: Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`https://agentprime.io/advisories/CVE-2026-72872/https://agentprime.io/advisories/CVE-2026-72872/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:50:23 GMTCVEcriticalCVE-2026-72871: Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callbackhttps://agentprime.io/advisories/CVE-2026-72871/https://agentprime.io/advisories/CVE-2026-72871/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:47:58 GMTCVECVE-2026-72870: Dokploy: Command Injection via Docker Credentials in buildRemoteDockerhttps://agentprime.io/advisories/CVE-2026-72870/https://agentprime.io/advisories/CVE-2026-72870/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:45:17 GMTCVECVE-2026-72869: Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCEhttps://agentprime.io/advisories/CVE-2026-72869/https://agentprime.io/advisories/CVE-2026-72869/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:40:48 GMTCVEcriticalCVE-2026-72868: Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injectionhttps://agentprime.io/advisories/CVE-2026-72868/https://agentprime.io/advisories/CVE-2026-72868/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:39:08 GMTCVEcriticalCVE-2026-72867: Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)https://agentprime.io/advisories/CVE-2026-72867/https://agentprime.io/advisories/CVE-2026-72867/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:36:54 GMTCVEcriticalCVE-2026-72866: WebSocket Terminal Auth Bypasshttps://agentprime.io/advisories/CVE-2026-72866/https://agentprime.io/advisories/CVE-2026-72866/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:34:34 GMTCVECVE-2026-72865: Dokploy: OS Command Injection via compose `composePath`https://agentprime.io/advisories/CVE-2026-72865/https://agentprime.io/advisories/CVE-2026-72865/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:33:05 GMTCVEcriticalCVE-2026-72864: Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)https://agentprime.io/advisories/CVE-2026-72864/https://agentprime.io/advisories/CVE-2026-72864/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:31:24 GMTCVEcriticalCVE-2026-72863: Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker hosthttps://agentprime.io/advisories/CVE-2026-72863/https://agentprime.io/advisories/CVE-2026-72863/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 18:28:22 GMTCVEcriticalCVE-2026-72862: Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCEhttps://agentprime.io/advisories/CVE-2026-72862/https://agentprime.io/advisories/CVE-2026-72862/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:59:47 GMTCVEcriticalCVE-2026-72740: Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`https://agentprime.io/advisories/CVE-2026-72740/https://agentprime.io/advisories/CVE-2026-72740/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:55:47 GMTCVEcriticalCVE-2026-72739: Dokploy: Command Injection via Compose Shell Executionhttps://agentprime.io/advisories/CVE-2026-72739/https://agentprime.io/advisories/CVE-2026-72739/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:53:33 GMTCVECVE-2026-72738: Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameterhttps://agentprime.io/advisories/CVE-2026-72738/https://agentprime.io/advisories/CVE-2026-72738/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:49:44 GMTCVEcriticalCVE-2026-72737: Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backupshttps://agentprime.io/advisories/CVE-2026-72737/https://agentprime.io/advisories/CVE-2026-72737/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:47:50 GMTCVEcriticalCVE-2026-72736: Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCEhttps://agentprime.io/advisories/CVE-2026-72736/https://agentprime.io/advisories/CVE-2026-72736/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:40:44 GMTCVEcriticalCVE-2026-72735: Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote executionhttps://agentprime.io/advisories/CVE-2026-72735/https://agentprime.io/advisories/CVE-2026-72735/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:34:36 GMTCVEcriticalCVE-2026-72734: Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registrationhttps://agentprime.io/advisories/CVE-2026-72734/https://agentprime.io/advisories/CVE-2026-72734/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:29:30 GMTCVECVE-2026-72733: Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restorehttps://agentprime.io/advisories/CVE-2026-72733/https://agentprime.io/advisories/CVE-2026-72733/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:26:29 GMTCVEcriticalCVE-2026-45629: Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpointhttps://agentprime.io/advisories/CVE-2026-45629/https://agentprime.io/advisories/CVE-2026-45629/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 16:40:59 GMTCVEcriticalCVE-2026-43917: Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validationhttps://agentprime.io/advisories/CVE-2026-43917/https://agentprime.io/advisories/CVE-2026-43917/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 16:40:05 GMTCVECVE-2026-45628: Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipelinehttps://agentprime.io/advisories/CVE-2026-45628/https://agentprime.io/advisories/CVE-2026-45628/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 16:33:23 GMTCVEcriticalCVE-2026-45630: Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statementhttps://agentprime.io/advisories/CVE-2026-45630/https://agentprime.io/advisories/CVE-2026-45630/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 16:15:36 GMTCVEcriticalCVE-2026-45631: Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secrethttps://agentprime.io/advisories/CVE-2026-45631/https://agentprime.io/advisories/CVE-2026-45631/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 16:13:59 GMTCVEcriticalCVE-2026-45632: Dokploy: Schedule Authorization Bypass Enables Host/Server Command Executionhttps://agentprime.io/advisories/CVE-2026-45632/https://agentprime.io/advisories/CVE-2026-45632/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 16:11:19 GMTCVEcriticalCVE-2026-45633: Dokploy: Command Injection in /docker-container-logs Endpointhttps://agentprime.io/advisories/CVE-2026-45633/https://agentprime.io/advisories/CVE-2026-45633/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 16:10:20 GMTCVEcriticalCVE-2026-45661: Dokploy: Remote Code Execution through Path Traversalhttps://agentprime.io/advisories/CVE-2026-45661/https://agentprime.io/advisories/CVE-2026-45661/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 16:07:54 GMTCVEcritical