OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restore permission run arbitrary shell commands on the underlying Dokploy host. The backup.restoreBackupWithLogs tRPC subscription concatenates the user-supplied databaseName and backupFile fields directly into database restore and rclone shell pipelines, so crafted values break out of the intended command and execute via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the fixing pull request (#4862) ships a regression test enumerating working injection payloads, and the CVSS of 9.9 with scope change reflects full host takeover from a low-privileged application role.
Cross-tenant remote command execution in Dokploy (self-hosted PaaS) before 0.29.13 lets any authenticated user holding only the server:read permission run arbitrary OS commands on servers belonging to other organizations. The swarm tRPC endpoints never verified that the supplied serverId belonged to the caller's active organization, and getNodeInfo interpolated an attacker-controlled nodeId straight into a remote shell command, chaining a broken multi-tenant authorization flaw with OS command injection. No public exploit or CISA KEV listing has been identified, though the vendor security advisory and a fix-verification test are public.
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service provisioning rights run arbitrary shell commands on managed remote servers. The user-controlled dockerImage field for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and libSQL services is interpolated unquoted into a 'docker pull ${dockerImage}' command executed over the remote-server code path (execAsyncRemote), enabling shell metacharacter injection. Rated CVSS 9.9 with a scope change; no public exploit or CISA KEV listing is identified, though the patch ships a regression test demonstrating the injection.
Remote command injection in Dokploy self-hosted PaaS before 0.29.13 allows an authenticated dashboard user to execute arbitrary shell commands on managed remote nodes. The registry credential-testing and Docker Swarm cluster-management endpoints interpolate user-controlled values (nodeId, imagePrefix/username driving the registry tag) into unquoted shell strings that run over SSH via execAsyncRemote. Rated CVSS 9.9 with scope change; no public standalone exploit is identified, though the public fix commit df2779e and advisory GHSA-4mfc-grxw-6858 disclose the exact vulnerable code paths and injection payloads.
OS command injection in duhow/xiaoai-patch (through commit fb07049), a community firmware-patch project for Xiaomi smart speakers, lets remote attackers run arbitrary shell commands on the device. The /mute and /unmute HTTP handlers in api/main.py pass the attacker-controlled silent query parameter straight into os.system(), so shell metacharacters break out of the intended command. Rated CVSS 9.8, but there is no public exploit identified at time of analysis and it is not on CISA KEV.
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.
Server-side template injection in ERPNext's Process Statement of Accounts feature (versions prior to 15.118.0 and 16.29.0) lets an authenticated user with a common operational role inject Jinja template expressions into the subject, body, and pdf_name fields, which are rendered with unrestricted globals including frappe.utils, yielding arbitrary server-side code execution. Tagged RCE/SSTI (CWE-1336) and rated CVSS 9.9 with scope change; no public exploit identified at time of analysis, but the trivial exploitation path and low privilege requirement make this a high-priority patch.
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deployment permission run arbitrary commands on the Dokploy host or a connected target server. The saveBitbucketProvider endpoint persists attacker-controlled bitbucketOwner and bitbucketRepository values without validation, and cloneBitbucketRepository later interpolates them straight into git clone commands run via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis, but the fix (0.29.13) ships regression tests demonstrating the injection payloads, so the mechanism is well documented.
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS commands inside the root Dokploy container, which holds the host Docker socket, effectively yielding host takeover. The destination.testConnection mutation interpolates unsanitized S3 fields (accessKey, secretAccessKey, region, endpoint, provider, bucket) into an rclone shell command run via child_process.exec. No public exploit is identified at time of analysis, but the fix is confirmed in v0.29.13 and the root cause is clearly documented in the upstream patch (PR #4873).
Privilege escalation to root in Dokploy (self-hosted PaaS) versions 0.29.2 through 0.29.12 lets a low-privilege organization member who has access to a single application escalate to full host command execution. Because schedule.create/schedule.update derive the internal serviceId from applicationId or composeId but only enforce the owner/admin host-schedule gate in the alternate branch, a member can bind their applicationId to a 'dokploy-server' (host-level) schedule and execute an arbitrary supplied script as root via schedule.runManually. No public exploit identified at time of analysis; fixed in 0.29.13.
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission to create or update service file mounts inject shell metacharacters via the filePath field, which Dokploy passes to the managed remote server over SSH. Because the default deployment model runs deployments directly against the configured host, this escalates from a web-UI form field to direct remote-host RCE. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum CVSS of 9.9 (scope-changed) reflects the severity of the primitive.
Remote code execution in NASA fprime-gds through version 3.4.3 lets an unauthenticated remote attacker fully compromise the ground data system and inject arbitrary commands to any connected spacecraft. The Flask ground station exposes every endpoint without authentication (CWE-306), while a path traversal in the upload/download handler permits reading and writing arbitrary files, and a hardcoded Flask secret key (CWE-321) enables session forgery; chained, they yield code execution on the ground station host. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a high-priority, real-world risk for anyone running F Prime ground software.
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore permission run arbitrary commands on the Docker-privileged host. The backup.restoreBackupWithLogs tRPC subscription forwards an attacker-controlled databaseName into shell strings that Node.js exec passes to /bin/sh before docker exec, so the outer host shell expands injected metacharacters. Rated CVSS 9.9 with a scope change to the host; no public exploit identified at time of analysis, though the upstream fix PR ships regression tests containing working injection payloads.
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose write and deploy permissions execute arbitrary commands on the Docker-privileged host. The compose.update operation persists an unvalidated composePath that is later interpolated verbatim into `docker compose -f`, `docker stack deploy -c`, and `touch` commands run via `/bin/sh -c`, so a crafted path fires shell metacharacters when the compose is deployed. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the upstream regression test suite demonstrates working injection payloads, making the path to exploitation well-understood.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Server-side command injection and path traversal in Dokploy, a self-hostable Platform-as-a-Service, allows an authenticated user holding certificate create or delete permission to supply a crafted certificatePath that is concatenated into shell commands without confinement or escaping. In versions before 0.29.13, this permits writing attacker-controlled content outside the certificate root, deleting arbitrary out-of-root directories, and - because the value reaches unquoted shell invocations (echo ... base64 -d > path, rm -rf certDir) - executing operating-system commands on the host. No public exploit has been identified at time of analysis, though the fixing pull request and commit are public; the flaw is fixed in 0.29.13.
Privilege escalation to host root in Dokploy self-hosted PaaS versions prior to 0.29.13 allows any authenticated organization member to hijack WebSocket terminal and log-streaming handlers that authenticate the session but never check the role/permission model enforced elsewhere. Because these handlers can open an interactive shell into any container - including the Dokploy container that mounts the Docker socket - a low-privileged tenant can obtain root on the host and cross every tenant boundary. No public exploit identified at time of analysis, though the upstream fix commit and a regression test are public. The CVSS is 9.9 driven by scope change and full CIA impact.
Privilege escalation via missing authorization in Dokploy, a self-hostable Platform-as-a-Service, lets any authenticated organization member open a root shell inside arbitrary containers on a self-hosted instance. The /docker-container-terminal WebSocket handler authenticated the caller but never checked the attacker-supplied containerId against the caller's role, organization, or service scope before invoking docker exec. Fixed in 0.29.13; no public exploit identified at time of analysis, though the upstream fix commit is public.
Remote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-schema-registry component, letting an attacker who can reach the affected interface load and run attacker-controlled classes and achieve full compromise (CWE-94). The flaw carries a critical CVSS 9.8 and is fixed in Ranger 2.9.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with EPSS at a modest 0.58% (45th percentile).
Arbitrary file write and delete as root in AsyncFuncAI DeepWiki-Open (through commit 16f35a0) lets unauthenticated remote attackers corrupt, overwrite, or destroy any file the host process can touch. The api/api.py wiki-cache endpoint builds filesystem paths directly from user-supplied owner, repo, and repo_type values without sanitization, and a second unauthenticated directory-creation endpoint completes the primitive so an attacker can traverse out of the cache directory. With no authentication (PR:N) and root-level execution, this is a direct path to full host compromise; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in dulldusk phpfm through 1.8.0 lets an unauthenticated attacker upload a malicious PHP file and run it directly on the server. The application ships insecure-by-default: its upload extension allowlist is empty ($upload_ext_filter = array()) and authentication is off (auth_pass is an empty string), so no credentials or configuration changes are needed to reach the vulnerable upload handler. No public exploit has been identified at time of analysis, but the trivial exploitation path and 9.8 CVSS make this a high-priority server-takeover issue for any exposed instance.
Missing authentication in dulldusk/phpFM through version 1.8.0 exposes the complete file manager to unauthenticated remote attackers because the default configuration ships with an empty auth_pass value. The flawed check in index.php (line 637, 'if ($auth_pass == '' || $loggedon==$auth_pass)') short-circuits to true whenever the password is unset, granting anyone full read, write, delete, and upload access to the server filesystem. CVSS 9.8 (CWE-306); no public exploit identified at time of analysis, though the vulnerable logic is directly visible in the referenced public source and is trivially reproducible.
Unauthenticated SQL injection in Tencent APIJSON (through 8.1.8) lets remote attackers bypass the framework's per-table role-based access control and read tables explicitly marked unreadable (get:[]). The APIJSONORM library validates the per-role allow-list only for the String form of the @having operator, so supplying @having in its Map form smuggles raw SQL fragments past the guard as an anonymous guest user. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network with no authentication.
Remote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letting an attacker who can influence a database connection string coerce the server into loading attacker-controlled JDBC driver behavior and executing arbitrary code on the Ranger host. This flaw affects the centralized authorization framework used to govern access across Hadoop-ecosystem services, so compromise undermines the very control plane meant to enforce data security. There is no public exploit identified at time of analysis and EPSS is low (0.36%, 29th percentile), but the fix in 2.9.0 and the critical 9.8 CVSS warrant prompt patching.
Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.
Authentication bypass in the Linux kernel SCTP stack allows the AUTH requirement to be silently skipped: sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL. On endpoints configured to require SCTP AUTH, a remote peer can get COOKIE-ECHO (and associated control chunks) processed without the mandated authentication, either by omitting the preceding AUTH chunk or by exploiting a receive-path skb_clone() failure. The fix rechecks sctp_auth_recv_cid() and drops the chunk when authentication is required. No public exploit identified at time of analysis; EPSS is low (0.20%).
Improper resource teardown in the Linux kernel's SCTP subsystem leaves per-net UDP tunnel sockets installed when a network namespace is destroyed, creating a use-after-free/dangling-socket condition once the control socket is released. The flaw affects systems where SCTP UDP encapsulation (net.sctp.udp_port) has been enabled inside a namespace before that namespace exits. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the fix has already been merged to multiple stable trees. Note: the supplied 9.8/AV:N CVSS is inconsistent with the local, namespace-scoped nature of the actual defect.
Out-of-bounds memory read in the Linux kernel's in-kernel Ceph client (libceph) allows a malicious or compromised Ceph monitor/OSD to crash or potentially leak kernel memory from any host mounting CephFS or RBD. The flaw lives in decode_new_up_state_weight() when parsing a CEPH_MSG_OSD_MAP message: an attacker-controlled length field feeds a multiplication used for a bounds check, and the overflow makes the check pass so the decoder reads past the buffer. EPSS is low (0.20%, 10th percentile) with no public exploit identified at time of analysis; the CVSS 9.8 appears inflated for what is fundamentally an OOB read reachable only from the Ceph messaging path.
Use-after-free in the Linux kernel's libceph (Ceph client) authentication code lets a stale pointer to a freed ceph_buffer be transmitted during a msgr1 reconnect, triggering a KASAN slab-use-after-free in _copy_from_iter() as tcp_sendmsg() copies the authorizer. The flaw affects hosts acting as Ceph clients (RBD, CephFS, rados) and can crash the client kernel and potentially leak freed slab memory over the wire. It is patched upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory access in the Linux kernel's libceph client (crush_decode) lets a malformed CRUSH map drive the CRUSH mapper into indexing the OSD weight array with a negative value. Because bucket type 0 is reserved for leaf devices, a bucket wrongly decoded with type 0 causes a negative bucket ID to be treated as a device and passed to is_out(), yielding an out-of-bounds read that can leak kernel memory or crash the host. Exploitation requires the kernel Ceph client to process the crafted map (i.e., connection to a malicious or compromised Ceph cluster); there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Stack out-of-bounds write in the Linux kernel's libceph client (net/ceph/osdmap.c) allows a malicious or compromised Ceph monitor to corrupt kernel stack memory on any client that mounts cephfs or maps RBD storage. The __decode_pg_temp() and __decode_pg_upmap_items() helpers accepted an attacker-controlled OSD-set length without bounding it to CEPH_PG_MAX_SIZE (32), so an oversized pg_temp/pg_upmap entry in an OSDMap is copied into the fixed-size on-stack ceph_osds.osds[32] array, triggering a KASAN-confirmed stack overflow that can panic the kernel and potentially enable privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not on the CISA KEV list.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subflow teardown path allows a stale skb->sk pointer to survive after a subflow socket is freed, leading to a kernel warning in inet_sock_destruct() and a use-after-free in mptcp_backlog_purge(). The flaw affects Linux 6.19 and is fixed in 7.1.6 and 7.2-rc5; it is a race condition between subflow close and concurrent softirq RX backlog processing. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.19% (9th percentile).
Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissions by manipulating a URL parameter, undermining the very access-control layer Ranger is meant to enforce across Hadoop-ecosystem services. Apache rates it CVSS 9.8 with a network, low-complexity, no-privilege vector, though the 'privilege escalation' framing implies a pre-existing foothold that is worth verifying. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile), indicating no observed mass-exploitation activity yet.
SQL injection in the Term Pages WordPress plugin (versions before 2.0.0) allows unauthenticated remote attackers to execute arbitrary SQL queries against the WordPress database by submitting a crafted request containing a malicious parameter. The vulnerability stems from missing input sanitization and output escaping prior to SQL statement construction (CWE-89). A publicly available exploit exists per WPScan, though EPSS sits at just 0.18% (7th percentile), suggesting exploitation remains limited at this time despite accessible proof-of-concept code. No CISA KEV listing has been confirmed.
Use-after-free in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem lets a local actor trigger a write to freed slab memory via the accept() error path of tipc_sk_create(). When socket insertion into the per-netns rhashtable fails, sock->sk is left dangling instead of NULLed, so tipc_release() bypasses its own NULL guard and calls lock_sock() on the freed sk. It affects kernels using the AF_TIPC protocol across many stable branches (fixes backported to 5.4.x through 6.18.x and mainline 7.x); there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.18%.
Incorrect checksum computation in the Linux kernel's s390 (IBM Z mainframe) architecture code causes csum_partial() to read from memory address zero instead of the intended source buffer on machines lacking the vector (VX) facility. Affects s390 systems running the buggy kernel builds; the practical effect is corrupted checksums and potential leakage of kernel memory contents near address zero into computed checksums. Rated CVSS 9.8 by automated scoring, but this is a local architecture-specific correctness bug with no public exploit identified at time of analysis and a low EPSS (0.18%, 7th percentile).
Use-after-free in the Linux kernel's Phonet PEP (Pipe End Point) receive path lets an attacker trigger memory corruption via crafted Phonet packets. In pep_get_sb(), a call to pskb_may_pull() can reallocate the skb data buffer, but the code keeps dereferencing the now-stale header pointer, producing a slab use-after-free read confirmed under KASAN. The flaw affects kernels from 2.6.28 through the fixed stable releases and is tagged as an information-disclosure issue; no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS score (0.18%).
Local kernel memory corruption in the Linux net/x25 subsystem allows an attacker to trigger a slab-use-after-free in x25_kill_by_neigh() by racing a neighbour (X.25 link) teardown against a socket close. The function drops x25_list_lock before calling lock_sock() without holding a socket reference, so a concurrent x25_release() can free the struct sock/x25_sock that the teardown path then dereferences, leading to a crash or potential privilege escalation. No public exploit identified at time of analysis; a KASAN reproducer under QEMU confirmed the flaw, and EPSS exploitation probability is very low (0.18%).
Kernel panic (denial of service) in the Linux kernel networking GRO path affects systems that forward or aggregate traffic. skb_gro_receive_list() is missing the NAPI_GRO_CB(skb)->flush validation that skb_gro_receive() already has, so flush-marked, already-aggregated frag_list packets get re-aggregated, corrupting the frag_list chain; a later skb_segment() on the TX path then dereferences a NULL/corrupted pointer and crashes the kernel. No public exploit identified at time of analysis and EPSS is low (0.18%), but a stable patch is available. Despite the NVD CVSS of 9.8, the described impact is availability-only (crash), not code execution.
Slab use-after-free in the Linux kernel's ILA (Identifier Locator Addressing) IPv6 module allows a remote attacker to trigger memory corruption by sending crafted IPv6 packets through a configured ILA csum-adjust-transport route or receive-side mapping. The flaw stems from ila_csum_adjust_transport() and ila_update_ipv6_locator() caching a stale IPv6 header pointer across a pskb_may_pull() call that can reallocate the skb head, leading to reads and a locator write through freed memory. No public exploit is identified at time of analysis, and EPSS exploitation probability is low (0.18%); the issue is patched upstream.
Length-underflow in the Linux kernel's Open vSwitch (openvswitch) datapath lets a truncation delta be reused across GSO segments, so a segment can reach queue_userspace_packet() with a stored cutlen larger than skb->len and pass an underflowed length to skb_zerocopy(). The affected code is the OVS_ACTION_ATTR_TRUNC (packet truncate) path feeding userspace upcalls, and the flaw is tagged Information Disclosure, consistent with an out-of-bounds copy of adjacent kernel memory into the userspace listener (and/or a kernel crash). It is fixed in stable kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Client-side data-integrity failure and bounded out-of-bounds read in the Linux kernel SMB/CIFS client (smb3_simple_fallocate_range) allows a malicious or compromised SMB server to cause the client to skip zero-filling holes during fallocate, so a range the client reports as successfully allocated is left as an un-zeroed hole and a later write can fail with ENOSPC; a malformed server-supplied range length can additionally trigger an out-of-bounds read of the zero buffer. Affected systems are Linux hosts that mount SMB3 shares and call fallocate on them; the fix is merged upstream and backported to stable trees. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.17% (6th percentile).
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) allows the async oplock/lease break notification worker to operate on a freed ksmbd_conn object when connection teardown races with a pending break notification. Affected kernels span the 6.6.x through 6.18 stable series (fixed in 6.6.148, 6.12.101, 6.14, 6.18.42 and related patch releases); the fix pins a real conn reference for the queued work item. Rated CVSS 9.8 by the automated feed, but this is a timing-dependent race with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Memory corruption in the Linux kernel's AMT (Automatic Multicast Tunneling) driver stems from multiple receive and transmit paths caching skb-head pointers (ip_hdr, ipv6_hdr, eth_hdr, and AMT message headers) that are then invalidated by pull/reallocation helpers, leaving dangling pointers that are dereferenced as a use-after-free of the freed skb head. Systems acting as AMT gateways or relays that process attacker-supplied tunneled multicast packets are affected across kernels from 5.16 up to the fixed stable releases. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), but the flaw is a network-reachable kernel UAF that could enable denial of service or, potentially, code execution.
Use-after-free in the Linux kernel's IPsec transmit path (xfrm) occurs when validate_xmit_xfrm() processes a GSO segment list and async crypto offload steals the final segment via -EINPROGRESS, leaving the list head's ->prev pointing at a segment now owned (and potentially freed) by the crypto engine. validate_xmit_skb_list() then writes through that stale tail pointer, corrupting freed memory; the practical impact is kernel memory corruption and likely crash on systems using IPsec with asynchronous crypto. No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV, so this is a patch-and-move-on issue rather than an active-exploitation emergency.
OS command injection in EFM ipTIME AX8004M firmware 15.09.0 exposes routers to unauthenticated remote code execution via the `fname` parameter of the `/cgi/d.cgi` CGI endpoint, where unsanitized input is passed directly to the `popen()` function. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path for affected devices. Despite a CVSS 4.0 score of 6.9 (Medium) with limited impact metrics, the combination of no-authentication network access, arbitrary OS command execution capability, and an available PoC represents materially higher practical risk than the score reflects - no public exploit identified at time of analysis is explicitly not applicable here, as publicly available exploit code exists.
OS command injection in Dokploy self-hostable PaaS versions prior to 0.29.13 lets an authenticated user with application create or update permission achieve arbitrary command execution on the build host. The dockerImage field is interpolated unquoted into shell commands in buildRemoteDocker() (packages/server/src/utils/providers/docker.ts) and validated only as an optional string, so shell command substitution such as $(...) or backticks runs on the local build host or a remote SSH build target. The upstream fix and its regression test publicly demonstrate working injection payloads, so publicly available exploit code exists, though there is no public exploit identified as weaponized and no CISA KEV listing; EPSS was not provided.
Cross-tenant authorization bypass in fosrl Pangolin through v1.20.0 lets an authenticated user reuse an access token minted for one resource to authenticate against any other resource in any organization. Because the authWithAccessToken.ts handler validates the token without binding it to the requested resourceId, a token scoped to resource X in organization A is accepted for resource Y in organization B, collapsing multi-tenant isolation. Rated CVSS 9.6 (CWE-639); no public exploit identified at time of analysis, though the vulnerable code path is disclosed in the referenced source file.
OS command injection in Dokploy self-hosted PaaS (versions prior to 0.29.13) lets an authenticated admin/owner execute arbitrary commands on the underlying host, not merely inside a managed container. The backup/restore, destination, volume-backup, certificate, and mount code paths build bash -c/sh -c strings by directly interpolating user-controlled, database-backed fields (S3 credentials, paths, volume names) and run them through child_process.exec(). No public exploit is identified at time of analysis, but the fix in 0.29.13 confirms multiple confirmed injection sinks, and the container-to-host scope escape makes successful exploitation a full host compromise.
Cross-tenant authorization bypass in Dokploy 0.29.8 and earlier lets an authenticated organization member with backup permissions reach another organization's S3 backup destinations by supplying a client-controlled destinationId that is never checked against their active organization. Because the referenced destination's S3 accessKey and secretAccessKey are materialized on the attacker's service host, the attacker can read a victim tenant's backup objects and redirect or poison backups across tenant boundaries. No public exploit identified at time of analysis, but the flaw is trivially reachable and breaks the core multi-tenant isolation of the platform (CVSS 9.6, scope-changed).