Docker
Monthly
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 67.3% and no vendor patch available.
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attackers to overwrite the host runc binary. By exploiting a race condition during container exec, a malicious container process can gain root access to the host system, breaking the fundamental container isolation boundary.
Improper TLS certificate validation in the Docker client shipped as the Alpine Linux docker package before 29.8.2-r0 allows an attacker who already occupies a man-in-the-middle position on the network path to impersonate a legitimate registry or daemon endpoint and have forged or otherwise invalid certificates accepted. Successful exploitation requires the victim to initiate the affected TLS connection (passive user interaction), but grants high confidentiality and integrity impact over the redirected traffic, since the client trusts the attacker-supplied certificate instead of rejecting it. No public exploit code or confirmed active exploitation was identified at time of analysis, and the fix is a package update to docker 29.8.2-r0.
An authorization bypass in Arcane before 2.11.0 lets anyone holding a valid environment-scoped access token reach administrator-only routes by presenting that token in the X-Arcane-Agent-Token header, which skips the WithAdminRequired check. The exposed surface is the manager's Go pprof diagnostic interface under /api/debug/pprof/*, so the practical impact is read-only disclosure of runtime and profiling data plus possible profiling overhead, not code execution or configuration change (CVSS 4.3, CWE-863). Exploitation is authenticated - the attacker must already possess a legitimate environment access token (CVSS PR:L) - and no public exploit code has been identified at time of analysis; the flaw is corrected in Arcane 2.11.0.
Decryption of stored TOTP secrets and credentials in FileRise manual (non-Docker) installations from 3.9.0 before 3.22.0 is possible when the instance runs on a published legacy compatibility key because neither PERSISTENT_TOKENS_KEY nor metadata/persistent_tokens.key is present. An attacker must separately obtain the ciphertext-bearing account or configuration files (such as persistent_tokens.json, adminConfig.json, or the users file) before the known key can be used, so the medium CVSS 5.9 rating reflects high attack complexity and a narrow set of prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in 3.22.0.
Server-side request forgery in Portkey AI Gateway 1.14.0 through 1.15.2 lets unauthenticated remote attackers make the gateway issue requests to loopback and Docker host services and return the responses to the caller. The flaw exists because the isValidCustomHost check trusts localhost-style hostnames whenever the TRUSTED_CUSTOM_HOSTS environment variable is unset, which is the default configuration; an attacker only needs to send a /v1 request carrying a crafted x-portkey-custom-host header (for example via the ollama provider). Publicly available exploit code exists for this issue and it is not listed in CISA KEV, so exploitation activity is not confirmed; the assessed impact is limited to confidentiality and integrity of services reachable from the gateway host, with no availability or code-execution impact.
Manifest and blob digest verification bypass in the CNCF Distribution registry client (all versions prior to 3.1.2) lets an attacker who controls the registry HTTP response - by operating a malicious or compromised registry, or by holding a TLS-intercepting man-in-the-middle position - substitute attacker-chosen manifest content even when the caller pinned the request by digest, with the forged Docker-Content-Digest header presented as the requested value. The flaw is unauthenticated from the client's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N, 6.8) and scopes out of the client because the bundled pull-through proxy (registry/proxy/proxymanifeststore.go) can cache and re-serve the substituted manifest to downstream consumers, making this a conditional supply-chain integrity issue rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.1.2.
FrankenPHP's official Debian and Alpine Docker images prior to 1.12.5 ship a placeholder /app/public/index.php that executes phpinfo(), so any derived image that never replaced that file serves a full diagnostics page from its web root; a single unauthenticated HTTP GET (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) discloses environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and filesystem paths. The precondition is narrow and non-default: only containers built from those official base images and left with the untouched placeholder are exposed, while deployments that supply their own /app/public/index.php per the documented pattern are not affected. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the fix is a simple base-image bump to 1.12.5 plus a rebuild of every derived image, since existing derived images keep the placeholder even after the upstream fix.
Blind server-side request forgery in Crawl4AI before 0.9.4 lets unauthenticated remote attackers bypass Docker egress controls via the RobotsParser.can_fetch robots.txt fetch path, using HTTP redirects or DNS rebinding to reach loopback, internal, and cloud-metadata addresses for service discovery. Rated CVSS 4.0 6.9 (Medium), exploitation requires the check_robots_txt behavior to be in effect when the service processes an attacker-influenced target URL, which makes the Docker service being reachable by untrusted callers a precondition. The SSRF is blind, so responses are not returned to the attacker, keeping confidentiality impact low; no public exploit code or confirmed active exploitation was identified at time of analysis.
Hard-coded git credentials embedded in the distributed Docker image of FunnyWolf Viper up to and including version 3.1.11 are recoverable from the file /root/viper/.git/config, granting whoever obtains the image - or reaches a deployment that exposes the .git directory - access to the secrets stored there. Publicly available exploit code exists, published alongside a GitHub advisory and a VulDB submission, so the technique is trivially reproducible; there is no CISA KEV entry, so confirmed active exploitation in the wild is not established. With CVSS 4.0 scoring 5.5 (AV:N/PR:N/UI:N) but only LOW confidentiality impact and no integrity or availability effect, this is best treated as a low-to-moderate credential-disclosure issue rather than a pre-authentication remote compromise.
Docker Sandboxes can forward an unrecognized client-supplied credential in an alternate authentication header alongside the credential injected by the host egress proxy, potentially authenticating an outbound request to an attacker-controlled upstream account and exposing data included in that request. The proxy scrubs alternate credentials only when their values match known sentinel values, so untrusted code already running inside an authorized sandbox can bypass that removal if the targeted upstream service accepts another supported auth header. This is a local, moderate-severity confidentiality issue requiring sandbox code execution and credential injection to be enabled; no public exploit identified at time of analysis.
Docker Sandboxes credential-injection proxies can fail open and expose host-managed credentials - OAuth access and refresh tokens and a derived Anthropic API key - to code already running inside an authorized sandbox, defeating the masking control that is meant to keep those secrets outside the sandbox boundary. Exploitation requires an attacker to already have code executing in a sandbox configured to proxy host-managed credentials (PR:L) and depends on an edge condition where a proxied response-body read returns data together with an error, causing affected handlers to forward unmasked bytes instead of redacting them; because that error-plus-data condition is not guaranteed on every request (AT:P), reliability is limited and sandboxes that do not use credential injection are not affected. The vendor CVSS 4.0 base score is 5.9 and our independent assessment is CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:N/C:H/I:N/A:N; no public exploit code or CISA KEV entry was identified at the time of analysis, and the primary limiting factor on real-world risk is that the attacker must operate from within the sandbox trust boundary.
Docker Sandboxes can expose host-managed OAuth access and refresh tokens to untrusted code inside a sandbox when the managed-credential injection feature is in use and a user actively completes the OAuth authorization flow. A case-sensitivity mismatch in token-endpoint hostname masking (CWE-178) lets malicious code request a case-variant hostname that reaches the genuine provider while bypassing response masking; exploitation requires local code execution inside the sandbox plus user interaction, not a remotely exploitable, no-interaction attack. No public exploit identified at time of analysis, and no KEV or EPSS data is provided; the independent assessment rates this as a moderate-priority confidentiality issue rather than a high-urgency emergency.
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Docker volume by submitting a small single-stream compressed file (e.g., .gz, .bz2, .xz, .lzma, .lz) that decompresses to an effectively unbounded size. The flaw, CWE-409 decompression bomb, bypasses the entry-count, nesting-depth, and uncompressed-byte limits that scripts/safe-extract.py applies only to container archives (zip/tar/rar/7z via libarchive), causing disk exhaustion that disrupts OpenSearch, Logstash, Arkime, and Zeek for all users. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation requires valid credentials with upload permissions and results in availability impact only (CVSS 6.5).
Cross-organization repository metadata disclosure in the Katello (Red Hat Satellite 6) Docker Tags repositories API allows an authenticated user who holds product-view permissions in one organization to retrieve repository configuration data for Docker meta tags owned by a different organization by simply supplying that foreign tag identifier. The weakness is an authorization-scoping gap (CWE-639, IDOR-style) correctly rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with impact limited to low-severity confidentiality loss - there is no write or denial-of-service effect. Exploitation requires valid credentials, multi-organization deployment, and knowledge or enumeration of valid foreign tag identifiers; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not supplied.
Information disclosure and entitlement bypass in Docker Buildx Bake allows an attacker-supplied Bake definition to read files that should have required an explicit fs.read entitlement approval. An unauthenticated attacker can craft a definition that exposes a readable file via a pathless secret whose ID is interpreted as a client-side pathname, or that consumes a local OCI image layout outside the project because entitlement validation checks a different path representation than the one actually used. Exploitation requires the victim to run an untrusted Bake definition (CVSS 4.0 AV:N/AC:L/PR:N/UI:A, assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), impact is read-only with no code execution, write, or availability loss, and no public exploit has been identified at time of analysis; environments that build only their own trusted first-party Bake definitions are not exposed. This is a genuine but moderate-priority entitlement-bypass issue rather than a critical remote threat.
Laradock through 20.4 fetches code during its workspace Dockerfile build without verifying integrity, allowing a network-positioned attacker to substitute or intercept that download and influence the build with limited confidentiality, integrity, and availability impact. Exploitation requires a user to actively start the build (UI:P) and is rated high complexity, and while publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV). The issue is low priority given the network-positioning prerequisite, build-time-only window, and limited impact.
Missing authentication on AiSOC's response-action API endpoints lets adjacent-network attackers reach the actions service without credentials in versions 9.0.0 through 11.x when the shipped defaults are in use - AISOC_DEV_MODE enabled and AISOC_ACTIONS_SERVICE_TOKEN left empty. In that state the authorization guard in services/actions/app/security/authz.py exempts itself, so every mutating route answers unauthenticated, allowing an attacker to enumerate response-action integrations, submit and approve actions as arbitrary principals, and trigger host-isolation or account-disable containment actions through the platform's own vendor credentials. Exploitation is deployment-gated rather than universal: it requires network reachability to the actions-service port (adjacent/internal), and no public exploit code was identified at time of analysis. Vendor patching is available in AiSOC v12.0.0.
heym before 0.0.105 fails to enforce credential authorization in its Redis workflow node, letting an authenticated workflow author cause the node to fall back to unauthenticated defaults on the backend's loopback interface. When the credential lookup returns no accessible credential - because the ID does not exist, was deleted, or belongs to another user - the node treats the failure as empty configuration and connects to localhost:6379 with no password, executing the requested Redis operation there. The impact is deployment-gated: the stock docker-compose.yml ships no Redis, so default installs only surface a misleading connection error, while operators who have placed a passwordless Redis on loopback face unauthorized read/write access; no public exploit has been identified at time of analysis and no EPSS or KEV signal is available.
AzuraCast deployments before 0.23.8 expose a server-side request forgery and local file read flaw in the AutoDJ remote playlist fetcher, letting an authenticated user who holds the station Media permission point a remote_url playlist at a file:// path or an internal/loopback HTTP endpoint and have the backend fetch it with file_get_contents(). The retrieved lines are stored as queue entries and then disclosed through GET /api/station/{station_id}/queue to any user with the Broadcasting permission, exposing host files readable by the web container (such as /etc/passwd or the application .env) and the bodies of non-blind internal HTTP requests. Exploitation is bounded by valid low-privilege authentication and by the privileges of the web container, and no public exploit code was identified at time of analysis; the advisory data states that no patched version was available at publication, so mitigation depends on disabling PHP allow_url_fopen or tightening Media-permission access.
Label-filter isolation in Dozzle 10.6.5 and earlier is bypassed through the SSE events endpoint (GET /api/events/stream), so any authenticated user - including one explicitly constrained by a users.yml 'filter:' label to a single container scope - receives live CPU/memory/network/disk telemetry and lifecycle metadata for every container on every monitored host. The flaw requires authorization to be enabled (e.g. DOZZLE_AUTH_PROVIDER=simple) and at least one account using per-user label filters, which is the standard multi-tenant or environment-segregated configuration; the attack needs only valid credentials (PR:L) and no special shell/actions/download role or victim interaction. Impact is bounded to metadata and telemetry (container name, image, full label map, and resource counters) rather than log contents, environment variables, or exec/attach capability, which is consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N rating of 4.3 (CWE-200). A lab-only proof-of-concept script is published in the vendor advisory demonstrating the leak; there is no evidence of active exploitation (not in CISA KEV).
Stored cross-site scripting in REDAXO CMS 5.x (affecting versions up to and including 5.21.1) lets an authenticated backend administrator plant HTML/JavaScript in a Media Manager effect type's name field, which is later rendered unescaped inside the 'media is in use' warning shown when another administrator tries to delete a referenced media file. Successful exploitation requires a second, victim administrator to click the Delete button on a specifically referenced media item, after which the payload runs in the victim's backend session and can be used for session hijacking, credential harvesting, or CSRF-token theft leading to full backend account takeover. Rated CVSS 3.1 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), this is a low-priority issue: it is not listed in CISA KEV and there is no evidence of active exploitation, though the vendor advisory publishes a full step-by-step proof-of-concept reproduction (publicly available exploit code exists). No EPSS score or in-the-wild telemetry was provided with this report.
Self-hosted draw.io deployments running the Docker or WAR build prior to 30.2.7 can have a victim's browser session silently bound to the attacker's own cloud-storage identity, because the OAuth callback handler skips verification of the state token against the session cookie whenever IS_GAE is false. An attacker who completes a legitimate authorization for their own account can then induce a victim to open a crafted callback URL, causing subsequent Google Drive, OneDrive, GitHub, GitLab, or Dropbox actions to be performed under the attacker's identity (CVSS 4.2, CVSS:3.1/AV:N/AC:H/PR:N/UI:R, CWE-352); the impact is session integrity loss and misattribution rather than disclosure of the victim's existing cloud files, and no public exploit identified at time of analysis. The hosted SaaS at app.diagrams.net and any Google App Engine build set IS_GAE=true and are unaffected.
Denial of service in the Thinkst Canary honeypot's optional Redis service can be triggered by unauthenticated remote attackers when that service is enabled, causing limited availability impact to the Redis service without confidentiality or integrity loss. The Canary is not affected if Redis is disabled, and the high attack-complexity score reflects that the trigger requires specific conditions rather than a reliable full-appliance outage. Thinkst has addressed the issue across supported platforms and published a patched Docker image, with automatic updates already in distribution; no public exploit identified at time of analysis.
Path traversal in rclone's Docker volume plugin ('rclone serve docker', versions 1.56.0 through 1.75.0) lets an attacker who can submit a VolumeDriver.Create request to the plugin socket make the privileged rclone process create a directory and mount an attacker-specified remote filesystem at an arbitrary host path. The attacker must already be in a high-privileged, socket-scoped position (PR:H) - normally the Docker daemon itself or, in a multi-tenant orchestration environment, a workload allowed to request named volumes - and no user interaction is required. Impact is bounded to unauthorized directory creation and remote-filesystem mounting over host paths rather than arbitrary code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in 1.75.1.
Let me synthesize. CVE-2026-91942: crawl4ai before 0.9.3, DOM-based XSS in Docker Playground UI, innerHTML assignment of untrusted crawl results. Malicious PDFs with event-handler markup execute JS in Playground origin, steal API tokens from sessionStorage. CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N — score 5.1. UI:A means user interaction active (user must open the PDF in the playground). Subsequent system impacts limited (SC:L/SI:L). PR:N unauthenticated. Wait — description says "steal API tokens from sessionStorage for authenticated API abuse" — the attacker themselves may be unauthenticated but the victim is an authenticated user. PR:N with UI:A. Let me construct fields. product_name: "Crawl4AI" (2 words? one token). Fine. prevalence: crawl4ai is a popular open-source LLM-friendly web crawler — medium? It's fairly widely used in AI/RAG pipelines. It's a Python library with ~40k GitHub stars. Deployment footprint: medium. Docker Playground UI is a specific deployment mode though — that reduces. I'd say "medium" with basis "popular open-source LLM crawler; Playground UI subset narrower". Hmm, but the specific vulnerable component (Docker Playground UI) is niche. But prevalence is about the product. crawl4ai is popular open-source library. Medium seems fair. assessed_cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — scope changed because it impacts the Playground origin / API tokens (sessionStorage tokens, the script executes in the Playground origin). Actually the CVSS 4.0 vector shows SC:L/SI:L which implies subsequent system impacts → in 3.1 that maps to S:C with C:L/I:L. Hmm, but is scope change right? The vulnerable component is the Playground UI; the impacted component is... the API tokens / authenticated API. The XSS executes in the Playground origin — same origin. Stealing sessionStorage tokens then abusing the API — the API is arguably a different security authority. Given the CVSS 4.0 has subsequent-sys
OCI artifact signature verification bypass in Doco-CD prior to v0.90.1 allows an attacker with write access to a monitored OCI registry tag to circumvent the global OCI_TRUST_POLICY enforcement and deploy unsigned or improperly signed artifacts. By publishing an artifact containing a crafted .doco-cd.yml with oci.verify: false, the attacker exploits a circular trust dependency - the tool reads per-deployment config from artifact contents before verifying that artifact - causing signature checking to be disabled for that same artifact. The vendor-released patch at v0.90.1 enforces a strict no-downgrade trust boundary; no public exploit has been identified at time of analysis.
Unauthenticated access to Mousehole's HTTP/WebSocket management interface (port 5010) exposes the stored MyAnonamouse (MAM) session cookie to any network peer in versions prior to 0.4.0. The service serializes its internal state - including the live MAM session cookie - identically across persisted storage, public API responses, and WebSocket push updates, meaning a passive read of any endpoint yields the credential. An attacker who can reach port 5010 can additionally overwrite the stored cookie and trigger MAM IP-update side effects, turning a disclosure into account manipulation. No public exploit code has been identified at time of analysis.
Renovate's `minimumReleaseAge` supply-chain defense control is not enforced for digest-type dependency updates, allowing a newly published - potentially malicious - package digest to immediately trigger a pull request and CI pipeline execution before the configured stability waiting period elapses. All Renovate versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0 are affected when repositories combine the `minimumReleaseAge` setting with digest-pinned dependencies such as GitHub Actions commit SHAs, Docker images, Go modules, or NuGet packages. No public exploit has been identified at time of analysis, but the flaw directly undermines an intentionally configured supply-chain defense, making it high-priority for organizations that depend on this control.
Stored cross-site scripting in the Venueless default Docker image allows a low-privileged authenticated user to upload an SVG file containing executable JavaScript, which executes in the browser of any user who subsequently views the file. The root cause is absent Content Security Policy enforcement combined with unfiltered SVG delivery, classified as CWE-80. The vendor addressed this by adding a valid CSP to the default image; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Uprobe-based gadget attachment in Inspektor Gadget (versions >= 0.27.0, < 0.53.1) can be weaponized by any unprivileged container to cause approximately 53 seconds of CPU burn in the IG daemon by supplying a crafted `/etc/ld.so.cache` file - no container capabilities required. Because IG uses fanotify hooks to pause container startup until uprobe attachment completes, and Docker serializes container starts behind that pause, a single crafted container effectively blocks all other containers on the host from launching for the duration of processing. The attack is amplifiable by starting multiple crafted containers simultaneously, and no public exploit has been identified at time of analysis.
Environment variable exposure in Renovate (versions 42.68.1 through 42.96.3 and 43.0.0 through 43.4.4) leaks the full process environment - including privileged credentials - into every child process spawned during dependency update operations. The regression was introduced inadvertently on 2025-12-30 when Renovate migrated to the `execa` library, whose default behavior extends rather than replaces environment variables, silently bypassing Renovate's intended allowlist filtering. Both insider attackers (with repository write access) and outsider attackers (via supply-chain compromise of a processed dependency) can embed credential-harvesting code in scripts that Renovate executes, exfiltrating GitHub tokens, registry credentials, and cloud IAM keys accessible to the deployment. No public exploit has been identified at time of analysis, but the vendor explicitly recommends rotating all credentials that affected Renovate instances had access to.
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
Remote code execution in UpTrain 0.7.1 and prior allows authenticated users to execute arbitrary commands on the host system via the `/new_run` API endpoint. The `checks` and `metadata` parameters are unsanitized, enabling injection attacks (CWE-74) that run in the context of the underlying process - typically a Docker container per the official deployment documentation. Publicly available exploit code exists (CVSS 4.0 E:P per GitHub Security Lab advisory GHSL-2024-200/201), and no vendor-released patch has been identified at time of publication.
Remote code execution in UpTrain's `/add_prompts` API endpoint allows any authenticated user to execute arbitrary commands on the host system by injecting malicious payloads into the `checks` or `metadata` parameters. Affected versions are 0.7.1 and prior, and deployments following the official documentation run inside Docker containers, meaning successful exploitation grants control of the container environment. GitHub Security Lab (GHSL-2024-200/201) has published an advisory and the CVSS 4.0 E:P modifier confirms publicly available proof-of-concept exploit code exists; no vendor-released patch has been issued as of time of publication.
Remote code execution in UpTrain v0.7.1 and prior is achievable by any authenticated user through the `/create_project` API endpoint, where the `checks` and `metadata` parameters are processed without adequate sanitization, allowing arbitrary code to run in the context of the host process. Discovered and reported by GitHub Security Lab (GHSL-2024-198/GHSL-2024-199), the flaw targets the dashboard backend (app.py:L691) and is most commonly exploited within Docker-based deployments as recommended by official documentation. No vendor patch exists as of publication, and a proof-of-concept is confirmed by the CVSS 4.0 E:P modifier, elevating real-world urgency despite the authentication prerequisite.
Predictable temporary file paths in Etherpad's import and export handlers expose multi-tenant deployments to a symlink-based file overwrite attack. All ep_etherpad-lite versions through v3.0.0 are affected; exploitation requires local host access, an unprivileged OS account, and - for high-impact scenarios - the Etherpad process running as root, a common default in many Docker base images. A proof-of-concept sketch is included in the vendor advisory GHSA-2jwf-f4xq-f24h; no public weaponized exploit code beyond that sketch exists and this vulnerability is not listed in the CISA KEV catalog.
Docker Sandboxes (sbx) fails to enforce read-only semantics on virtio-fs host mounts: the in-guest bind correctly receives the read-only flag, but the underlying host-edge grant omitted from the policy-share allowlist carries no access mode, leaving the shared-export path fully writable at the host level. Low-privileged code executing inside the sandbox can enumerate or derive the virtio-fs export path and write to host directories the operator explicitly attached as read-only, breaking the isolation guarantee that is the product's core security promise. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Dozzle's webhook SSRF guard can be bypassed by authenticated users in versions 10.5.2 through 10.6.14 by supplying webhook URLs that resolve to IPv6 transition addresses encoding blocked IPv4 targets such as 127.0.0.1 or 169.254.169.254. The `isBlockedIP` function in `internal/notification/dispatcher/webhook.go` validated literal IPv4 and native IPv6 addresses but did not unwrap IPv4 addresses embedded inside 6to4, NAT64, Teredo, or IPv4-compatible IPv6 forms, making the guard trivially circumvented by encoding a loopback or link-local address in any of those transition formats. The CVSS 4.0 score is 2.3; publicly available exploit code exists per SSVC classification, though no active exploitation has been confirmed and the vulnerability is not in CISA KEV.
Command injection in Dokploy's Docker build pipeline allows authenticated application editors to execute arbitrary OS commands on the Dokploy host by supplying shell metacharacters in the dockerContextPath build configuration field. The malicious path value flows from the dashboard UI through getDockerContextPath() directly into an unquoted cd shell command executed via execAsync, enabling full host-level code execution under the Dokploy server process. All Dokploy installations prior to version 0.29.13 are affected; no active exploitation or public exploit code has been identified at time of analysis, though exploitation requires only a low-privilege authenticated session.
Command injection in Dokploy's `createCommand()` function allows authenticated users with compose deployment access to execute arbitrary OS commands on the underlying Docker host. All Dokploy releases before 0.29.13 are affected via CPE cpe:2.3:a:dokploy:dokploy:*. The official CVSS score of 6.5 with C:H/I:N/A:N materially understates actual impact - successful exploitation yields full host-level command execution, not merely information disclosure. No public exploit identified at time of analysis, though working injection payloads are published directly in the fix commit's test suite.
Traefik's BasicAuth middleware in versions 3.6.11-3.6.24 and 3.7.0-3.7.9 permits an authenticated low-privilege user to forge arbitrary backend identities via a singleflight key collision race condition. By concatenating their known valid password with a retrieved stored bcrypt hash, an attacker crafts a singleflight deduplication key identical to a legitimate in-flight request's key; the middleware returns the legitimate request's successful authentication result to the attacker's request, then propagates the attacker's chosen unconfigured username to the backend as a trusted identity. A fully working proof-of-concept achieving 25-of-25 successful identity forgeries under default bcrypt cost is publicly available in the GitHub security advisory; no CISA KEV listing has been identified at time of analysis.
Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-privilege attacker to poison Docker and Fly.io setup commands displayed in the web interface, causing arbitrary shell code to execute on the machine of any user who copies and runs the generated command. Affected versions span 0.13.0 through 0.18.6 and 0.19.0 through 0.19.8. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 4.9 reflects the high privileges required and the indirect execution path through a secondary user's action.
Stored cross-site scripting in Ghost CMS feature image captions enables any authenticated staff user to inject unsanitized HTML into the post revision history modal, hijacking the Ghost Admin session of another staff or administrator user who views that revision. Affects Ghost npm package versions v4.9.0 through v6.54.0. No public exploit identified at time of analysis and not listed in CISA KEV, but the privilege escalation potential - a lower-privileged staff member compromising a full administrator session - makes this higher-impact than the CVSS 4.3 score implies for multi-tenant or shared Ghost Admin environments.
Server-Side Request Forgery in Ghost CMS v6.26.0-v6.54.0 allows unauthenticated remote attackers to abuse features such as Webmentions to issue blind HTTP requests from the Ghost server into its internal network, bypassing perimeter controls without returning response content to the attacker. The flaw stems from insufficient URL validation in outbound HTTP request handling, enabling internal host probing across a changed security scope (CVSS S:C). No active exploitation (CISA KEV) or public POC has been identified at time of analysis; the vendor has released a fix in v6.54.1.
Session fixation in Ghost Admin (v2.2.0-v6.54.0) allows an attacker who can plant a known session identifier in a victim's browser - via a secondary vulnerability on the same domain - to hijack an authenticated Ghost Admin session after the victim logs in. The root cause is that Ghost Admin's login flow did not call session regeneration, leaving the pre-login session ID valid post-authentication. Exploitation is chained and non-trivial, but the upstream fix (v6.54.1) is confirmed and straightforward to apply. No public exploit code and no CISA KEV listing identified at time of analysis.
Path traversal in Ghost CMS theme upload (CWE-22) allows an authenticated staff-level user to write arbitrary files outside the designated uploads directory, potentially altering the behavior of the entire Ghost installation. Affected versions span v0.10.0 through v6.54.0 of the npm/ghost package - a wide range covering essentially all modern deployments. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS Scope:Changed metric reflects that a successful write can affect components beyond the theme storage boundary, elevating the real-world impact above the moderate base score suggests.
Path traversal in Ghost's database backup export endpoint allows Administrator-level users to remotely overwrite arbitrary files on the server filesystem, affecting all Ghost installations from version 1.20.1 through v6.54.0 (npm package pkg:npm/ghost). An authenticated admin can supply a crafted export filename containing path separators (e.g., '../../etc/crontab') when triggering a database export, causing Ghost to write the JSON export blob outside the intended directory to an attacker-controlled path. No public exploit code exists and this CVE does not appear in CISA KEV at the time of analysis; however, the CVSS Scope:Changed rating reflects that successful exploitation crosses the application's filesystem boundary, with integrity and availability consequences beyond Ghost's own data directory.
Blind SSRF in Ghost Admin's image-size fetching module allows any authenticated staff-level user to issue arbitrary HTTP GET requests from the Ghost server to internal network hosts. Affecting all Ghost npm releases from v0.10.0 through v6.54.0, the flaw resided in the image dimension detection code path, which used an unprotected generic HTTP client with no SSRF controls when fetching external images for certain formats requiring a full response buffer. No public exploit or CISA KEV listing exists; no EPSS data was provided. The vulnerability was fixed in v6.54.1 by routing fetches through Ghost's SSRF-protected `externalRequest` got-based client.
Ghost CMS subscription checkout accepts redemption of archived offers due to missing offer-status validation in the member router controller, affecting all self-hosted Ghost instances from v4.22.0 through v6.54.0. Unauthenticated users who possess or can discover an archived offer ID can submit a valid checkout request and obtain unauthorized subscription discounts or access at a revoked price point. No public exploit code has been identified and this CVE is absent from CISA KEV, but the direct financial impact on subscription-based Ghost sites makes it a meaningful business-logic risk for affected operators.
Null byte injection in the free5GC Authentication Server Function (AUSF) v4.2.1 and earlier allows unauthenticated remote attackers to crash Go's URL parser and force HTTP 500 responses on the authentication endpoint, denying authentication service to all legitimate 5G subscribers sharing that AUSF instance. A publicly available Python PoC is included in the vendor's own security advisory, and fuzzing demonstrated a 4.1% trigger rate across nearly 100,000 requests - confirming reliable, scalable exploitation against the default deployment with no special configuration required. No public exploit or CISA KEV listing is confirmed at time of analysis, but the trivially automatable nature of the attack makes it a material risk for 5G core operators.
Authentication bypass in Cosmos-Server 0.22.18 and earlier allows any holder of a valid Constellation device API key to impersonate any user (including admin) to backend applications by sending crafted x-cosmos-user headers. The tokenMiddleware prematurely returns before stripping these headers when the request originates from the Constellation tunnel, bypassing JWT authentication, MFA, and the AdminOnly access gate. Publicly available exploit code exists but no active exploitation has been reported.
Remote unauthenticated denial of service in gopacket <= 1.6.0 via a single crafted sFlow UDP datagram that triggers an unbounded memory allocation of up to 16 GiB, causing the parsing process to be OOM-killed. Affected services include any network telemetry collector or application that uses gopacket’s sFlow decoder without additional validation. A proof-of-concept exploit exists and can crash the process with just a 104-byte packet.
Remote denial-of-service in the gopacket library's Diameter AVP decoder allows unauthenticated attackers to trigger a ~4 GiB memory allocation per crafted packet, causing OOM kill after two messages under memory constraints. The flaw affects gopacket ≤1.6.0 (latest before fix), and publicly available exploit code demonstrates end-to-end exploitation against a collector with a 256 MB memory cap. No active exploitation is currently reported.
OS command injection in localstack serverless-localstack up to version 1.4.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `custom.localstack.docker.compose_file` configuration argument processed by the Configuration Handler in `src/index.js`. A publicly available proof-of-concept exploit exists via GitHub issue #303, elevating practical risk beyond the moderate CVSS 4.0 base score of 4.8. No vendor patch has been released, as the project maintainer has not responded to the responsible disclosure reported through an issue report.
Remote denial-of-service in Gitea versions prior to 1.27.0 allows any authenticated user to crash the server by exploiting an O(N²) string concatenation flaw in the RFC 4716 SSH key parser. Submitting a single crafted SSH2 public key with hundreds of thousands of short content lines forces quadratic heap allocation that exhausts CPU and RAM within seconds, taking the entire Gitea instance offline. A functional, Docker-packaged proof-of-concept is publicly available per the Gitea security advisory; no active exploitation has been confirmed in CISA KEV, but the trivially low barrier - any valid user account suffices - elevates real-world risk considerably.
LFS deploy-key privilege escalation in Gitea (< 1.27.0) allows a holder of a write deploy key for any single repository owned by a victim to exfiltrate LFS objects from all private repositories that victim owns. The flaw originates in `routers/private/serv.go:275`, where Gitea embeds `repo.OwnerID` as the JWT `UserID` for deploy-key SSH sessions, causing the LFS batch handler at `services/lfs/server.go:268` to evaluate cross-repository authorization as if the repository owner - not the deploy key - were the requesting principal. If the victim is a Gitea site administrator, an unfiltered query in `models/git/lfs.go:226` exposes every LFS object on the entire instance. A public end-to-end PoC (poc.sh) is attached to the GitHub advisory; no CISA KEV listing exists at time of analysis.
RSS/Atom feed handlers in Gitea prior to v1.27.0 expose private repository content - commit metadata, release notes, tag names, and cross-repo activity streams - to holders of confined API tokens that are explicitly blocked from the same data via download routes. The bypass breaks the token-confinement guarantee introduced by PR #37698 for raw/archive/download handlers, which was never extended to the sibling feed endpoints despite those endpoints accepting identical token-based Basic auth. A working proof-of-concept is documented in the GHSA advisory verified against the official gitea/gitea:1.26.2 Docker image; the vulnerability is not confirmed in CISA KEV, and the primary realistic threat is a leaked or lower-trust token used in CI or third-party integrations circumventing its intended scope restrictions.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Token scope enforcement is bypassed on Gitea's repository home page handler (`repo.Home`), exposing private repository README, root file/directory tree, description, language statistics, license, and latest-release data to any authenticated PAT or OAuth2 token that lacks the `repository` scope or is marked `public-only`. This is the third in a series of related incomplete fixes - CVE-2026-20706 and CVE-2026-27761 patched sibling routes (archive download and RSS/Atom feeds) but the home route was overlooked, leaving it without the `CheckRepoScopedToken` guard applied to every neighboring handler. Publicly available exploit code exists in the form of a self-contained Docker-based proof-of-concept published in the vendor advisory; no active exploitation has been confirmed by CISA KEV.
Denial of service in Gitea's Debian package registry (all versions before 1.27.0) lets any authenticated user with package write access crash the server with a single .deb upload. The parser's ParseControlFile decompresses control.tar.gz with no size limit and tees the entire stream into a strings.Builder, so an 83 MB payload expands to 16+ GB and exhausts memory; a companion O(N²) string concatenation on Description continuation lines can independently saturate a CPU core. A complete working proof-of-concept is published in the advisory, so publicly available exploit code exists, though there is no public exploit identified as used in active attacks and the issue is not in CISA KEV.
OAuth token introspection in Gitea prior to v1.27.0 discloses token metadata - including active status, scope, username, and JWT registered claims - to any authenticated OAuth client regardless of whether that client is the token's intended audience, violating RFC 7662 section 4. Any registered OAuth application on the target instance can call `/login/oauth/introspect` with a token issued to a completely different client and receive a valid response. No public exploit is confirmed in CISA KEV, but a complete proof-of-concept reproduction script (`poc.sh`) is publicly attached to the GHSA advisory, making exploitation trivially reproducible by anyone with a registered OAuth client credential.
File Browser's share API (confirmed vulnerable through v2.63.16) leaks bcrypt password hashes and bypass tokens for password-protected shares via unfiltered JSON serialization of the internal `Link` storage struct. Authenticated users receive these secrets for their own shares on every create or list call, while administrators calling `GET /api/shares` obtain the password hash and bypass token for every user's shares across the entire instance. A working proof-of-concept is publicly available against the v2.63.15 Docker image; the exposed bypass token grants direct, password-free access to any protected share without cracking, while the bcrypt hash enables offline recovery of reused credentials.
Unauthenticated path traversal in Nuclio Dashboard's function build API allows arbitrary file write as root inside the Dashboard container. The `spec.handler` field accepts unsanitized module names containing `../` sequences, which Go's `path.Join`/`path.Clean` resolves to escape the build temp directory; the resulting path is passed to `os.WriteFile` running as `uid=0`. Versions up to and including 1.15.27 are affected; a full working proof-of-concept has been publicly disclosed, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Uncontrolled memory allocation in Envoy Gateway's OCI image fetcher allows a low-privileged tenant to crash-loop the shared controller cluster-wide. Versions before 1.7.4 and in the 1.8.x pre-release range before 1.8.1 are affected. By submitting an EnvoyExtensionPolicy referencing a malicious OCI registry serving a tar layer with a PAX/GNU-encoded multi-terabyte header size, an attacker triggers an unrecoverable Go runtime OOM in the controller - a single-request, non-volumetric, persistent denial of service that persists across restarts until the CRD is manually deleted. No public exploit identified at time of analysis.
Authenticated blind SSRF in Koel v9.6.0 allows any logged-in user to trigger server-side HTTP requests to private, loopback, and RFC1918 destinations by exploiting a missing SafeUrl validation guard on the Subsonic-compatible createPodcastChannel.view route. The main podcast API correctly rejects private URLs with a 422 error, but the Subsonic compatibility layer omits the same SafeUrl rule, and the attacker-supplied URL is fetched synchronously during channel creation via Poddle::fromUrl() - no separate step required. No public exploit identified at time of analysis per KEV status, but a fully documented public PoC with step-by-step curl commands is available in GHSA-w79m-f3jx-779v, validated against the official phanan/koel:9.6.0 Docker image.
Path traversal in psd-tools through v1.17.0 exposes any application processing untrusted PSD files to arbitrary file write and secondary arbitrary file read via the SmartObject API. SmartObject.save() consumes the embedded smart-object filename verbatim from the PSD binary - without basename stripping, absolute-path rejection, or directory-escape filtering - allowing a crafted PSD to write attacker-supplied bytes to any path the process can reach. A secondary issue in SmartObject.open() for external-kind objects uses the attacker-controlled fullPath descriptor as a read source, enabling file exfiltration to the write destination. A standalone proof-of-concept is publicly confirmed in the advisory; the fix is vendor-confirmed in v1.17.1 (PR #657). No public exploit identified at time of analysis beyond the advisory-embedded POC, and no CISA KEV listing was found.
Credential file exfiltration in SiYuan prior to 3.7.1 is possible through the POST /api/file/globalCopyFiles endpoint, which accepts arbitrary absolute source paths and relies on an incomplete denylist in util.IsSensitivePath to block sensitive files. The denylist omits common credential files including .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, enabling an authenticated administrator or API-token holder to copy these files into the workspace and read them via the file API. No public exploit code or CISA KEV listing exists at time of analysis, but the Docker tag suggests this is relevant in containerized deployments where host-mounted credential files may be accessible.
Unauthenticated access to the self-hosted HTTP transport of DeepSeek MCP Server (versions 1.4.2-1.7.x) allows any network-reachable client to initialize a valid MCP session, enumerate server tools, and invoke them without credentials - including `deepseek_chat`, which silently consumes the server operator's `DEEPSEEK_API_KEY`. Default Docker deployments expose port 3000 in HTTP mode out of the box, maximizing the attack surface for any container running on a network-accessible host. No public exploit has been identified at time of analysis, though the GitHub advisory references reproduced testing confirming the full bypass against commit `5e1302171e99`.
Open redirect in waku's `unstable_redirect()` server-side router helper allows a network attacker to redirect victims' browsers to arbitrary external domains - including phishing sites for credential harvesting and OAuth token theft - by injecting a malicious `location` string into any waku route that passes user-controlled query parameters to the function. The vulnerability affects waku 1.0.0-beta.0 across all supported runtime adapters (Node.js, Cloudflare Workers, Vercel Edge, Deno), as the reflection path in `handler.ts` is shared. A dynamic proof-of-concept was confirmed by the reporter in two independent Docker-based runs against commit 8e9f542; no vendor-released patch is confirmed at time of analysis, though a v1.0.0-beta.1 release tag appears in advisory references.
OS command injection in Coolify's database service configuration API allows authenticated administrators to execute arbitrary shell commands within Docker container contexts by embedding shell metacharacters into database credential fields. All Coolify versions prior to 4.0.0-beta.474 are affected, covering deployments managing Redis, KeyDB, Dragonfly, ClickHouse, PostgreSQL, and MySQL services. No public exploit code has been identified at time of analysis, and the CVSS PR:H requirement confines the attack surface to already-privileged admin accounts, positioning this as a post-compromise escalation risk rather than an initial access vector.
Stored cross-site scripting in Kiwi TCMS versions prior to 16.1 allows authenticated users to inject arbitrary JavaScript into the `TestCase.extra_link` and `TestPlan.extra_link` fields, which are rendered verbatim to all subsequent viewers. Official Docker-based deployments are substantially protected by a `Content-Security-Policy` header that blocks inline script execution, but customized deployments that alter default middleware or security settings remain fully exploitable. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
OS command injection in Coolify's settings module allows a highly privileged attacker in a development environment to execute arbitrary shell commands on the host server by injecting metacharacters into the dev_helper_version field, which is passed unsanitized into a Docker build command. All Coolify releases prior to 4.0.0-beta.474 are affected. No public exploit code exists and no CISA KEV listing has been issued; the provided CVSS score of 3.8 (Low) accurately reflects the highly constrained exploitation prerequisites, though the underlying command injection class warrants upgrade regardless.
Arbitrary file write as root via symlink attack in Linuxfabrik Monitoring Plugins affects any deployment using the provided sudoers configuration. The monitoring plugins create SQLite databases at predictable, static paths under /tmp; an attacker who has already gained access to the nagios service account can pre-place symlinks at those paths, and when a monitoring script is subsequently invoked via sudo, it follows the symlink and writes a SQLite database to any attacker-chosen path on the filesystem. A proof-of-concept is included in the GitHub Security Advisory GHSA-r35r-fpx2-jgr4, and no CISA KEV listing or CVSS score has been assigned at time of analysis.
Sandbox boundary enforcement failure in PentAGI (vxcontrol) versions up to 2.1.0 allows authenticated remote users to break Docker containment controls via the Docker API client component in `backend/pkg/docker/client.go`, enabling limited information disclosure and unauthorized low-impact modifications within the Docker environment. The CVSS 4.0 vector (PR:L, AV:N, AC:L) confirms low-privilege network-reachable exploitation with no user interaction required, though all impact metrics remain Low and no host-level breakout is indicated. No public exploit code exists and this vulnerability is not listed in CISA KEV; an upstream fix is pending as an unmerged GitHub pull request.
Unauthenticated OAuth client secret disclosure in Dragonfly Manager (dragonflyoss/dragonfly <= v2.4.3) exposes GitHub and Google OAuth client_secret values to any host that can reach the Manager REST API port. The GET /api/v1/oauth and GET /api/v1/oauth/:id handlers omit the jwt.MiddlewareFunc() and RBAC middleware enforced on every other admin route group in the same router file - including the write methods (POST, DELETE, PATCH) in the same /oauth group - and the models.Oauth struct serializes ClientSecret without redaction. A detailed proof-of-concept with captured output is included in the advisory; no CISA KEV listing is present and EPSS data is unavailable.
Unvalidated bearer realm URL handling in oras-go v2 ≤ 2.6.0 enables two distinct attack primitives against users who run oras operations against a malicious, compromised, or man-in-the-middle'd registry: server-side request forgery (SSRF) to internal network endpoints including cloud instance metadata services, and TLS downgrade that exposes user credentials in plaintext. The OCI distribution spec legitimately allows cross-host realm references for split-auth deployments (e.g., Docker Hub's auth.docker.io pattern), but oras-go failed to block private IP literals, loopback addresses, and scheme downgrades from https to http - patterns that are never legitimate under any valid registry trust model. No active exploitation has been confirmed (not in CISA KEV), and a patch is available in v2.6.1.
Memory exhaustion denial-of-service in Mailpit <= v1.30.0 allows unauthenticated remote attackers to consume excessive memory via unbounded JSON body on several API endpoints. An incomplete fix for a previous DoS leaves four sibling endpoints without size limits, enabling amplification of up to 28x RSS per request. Publicly available exploit code exists; EPSS indicates low exploitation probability (0.51%), but the vulnerability is easily exploited against default deployments.
Prototype pollution in @hey-api/openapi-ts affects all versions through 0.97.2, allowing remote unauthenticated attackers to substitute the prototype chain of the returned params slot object by passing a crafted key such as '$query___proto__' through any application that forwards user-supplied parameters to a generated SDK method. The flaw resides in a runtime template (dist/clients/core/params.ts) that is copied verbatim into every generated SDK, meaning every downstream npm package regenerated from this tool carries the vulnerable code - confirmed affected consumers include @opencode-ai/sdk and @trigger.dev/sdk. A functional proof-of-concept is publicly available; exploitation is not confirmed as actively exploited and is absent from CISA KEV.
Authentication bypass in Presenton's bundled MCP server exposes server and Docker deployments to unauthenticated remote exploitation via the unprotected /mcp endpoint. When operators configure session authentication using AUTH_USERNAME/AUTH_PASSWORD, nginx enforces access control on all paths except /mcp, which is absent from the auth_request gate - and the MCP server compounds this by auto-minting valid internal session tokens for the configured user on any incoming request. An unauthenticated remote attacker can therefore invoke MCP tools such as generate_presentation as if fully authenticated, consuming the operator's LLM API keys and writing arbitrary presentations to the instance. A publicly available proof-of-concept exists; no active exploitation confirmed in CISA KEV.
Command injection in Coolify prior to 4.0.0-beta.464 allows authenticated administrators to escape the Docker container and execute arbitrary commands on the host server. The vulnerability originates from the executeInDocker() helper that wraps commands in bash -c '{$command}' without escaping single quotes, enabling injection via user-controlled Docker compose fields. A proof-of-concept exploit exists, but no active exploitation is reported (EPSS 0.22%, low risk).
Credential exposure in turso-cli versions 1.0.25 and earlier allows any local user on the same host to read the Turso platform JWT stored world-readable at mode 0o644 in settings.json, granting full access to all Turso organizations the victim belongs to. The root cause is turso-cli's failure to override Viper's insecure default configPermissions before writing credentials - a deviation from the explicit 0o600 baseline established by comparable CLIs including gh, aws, docker, and gcloud. A proof-of-concept demonstrating the 0o644 mode is included in the advisory; no active exploitation is listed in CISA KEV.
Insufficiently protected credential storage in Dokku prior to 0.38.2 exposes git authentication secrets stored in $DOKKU_ROOT/.netrc to any local user who can traverse the Dokku home directory. The git:auth command pre-creates the .netrc file using bash's touch, which applies the process umask (0644) before the netrc binary runs - defeating the netrc binary's own 0600 enforcement because the file already exists at write time. No public exploit code exists and the vulnerability is not in CISA KEV, but the confidentiality impact is rated High given that plaintext git credentials (hostnames, usernames, passwords) are directly readable without any special tooling.
JWT algorithm confusion in Netflix Lemur 1.9.0 allows an attacker to control which signing algorithm the server trusts by supplying an arbitrary alg value in the unverified token header, which is passed directly to pyjwt.decode() instead of a server-pinned allowlist. On current PyJWT 2.x deployments the standalone impact is limited to audit-log blinding and a durable algorithm-downgrade primitive; full account takeover requires chaining with a separate LEMUR_TOKEN_SECRET disclosure vulnerability, after which a forged HS256 admin JWT yields HTTP 200 with role=admin. A public proof-of-concept walkthrough exists (asciinema); no active exploitation is confirmed in CISA KEV.
Stored XSS in the AWS API key store component of Thinkst Applied Research Canarytokens allows a low-privileged attacker who knows a token's random identifier to inject persistent malicious scripts that execute in a victim's browser when they view the affected token page. Exploitation is constrained by high attack complexity (AC:H), a prerequisite attack requirement (knowledge of a random identifier), low-privilege authentication, and active user interaction - reflected in an extremely low CVSS 4.0 base score of 1.1. No active exploitation is confirmed; however, the CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists.
Unauthenticated remote action execution in motionEye (pip/motioneye < 0.44.0) exposes every camera action endpoint - snapshots, recording start/stop, and administrator-configured shell scripts - to any attacker who can reach port 8765, due to a missing @BaseHandler.auth() decorator on ActionHandler.post(). Dynamically confirmed on v0.43.1 in a Docker lab environment; exploitation requires only a single HTTP POST with no credentials, headers, or user interaction. Beyond the CVSS 5.3 Medium rating, real-world impact extends to physical security bypass (PTZ, alarms, lighting controls) if action scripts are configured, and SSRF via remote camera triggering - no public exploit or CISA KEV listing is identified at time of analysis.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 67.3% and no vendor patch available.
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attackers to overwrite the host runc binary. By exploiting a race condition during container exec, a malicious container process can gain root access to the host system, breaking the fundamental container isolation boundary.
Improper TLS certificate validation in the Docker client shipped as the Alpine Linux docker package before 29.8.2-r0 allows an attacker who already occupies a man-in-the-middle position on the network path to impersonate a legitimate registry or daemon endpoint and have forged or otherwise invalid certificates accepted. Successful exploitation requires the victim to initiate the affected TLS connection (passive user interaction), but grants high confidentiality and integrity impact over the redirected traffic, since the client trusts the attacker-supplied certificate instead of rejecting it. No public exploit code or confirmed active exploitation was identified at time of analysis, and the fix is a package update to docker 29.8.2-r0.
An authorization bypass in Arcane before 2.11.0 lets anyone holding a valid environment-scoped access token reach administrator-only routes by presenting that token in the X-Arcane-Agent-Token header, which skips the WithAdminRequired check. The exposed surface is the manager's Go pprof diagnostic interface under /api/debug/pprof/*, so the practical impact is read-only disclosure of runtime and profiling data plus possible profiling overhead, not code execution or configuration change (CVSS 4.3, CWE-863). Exploitation is authenticated - the attacker must already possess a legitimate environment access token (CVSS PR:L) - and no public exploit code has been identified at time of analysis; the flaw is corrected in Arcane 2.11.0.
Decryption of stored TOTP secrets and credentials in FileRise manual (non-Docker) installations from 3.9.0 before 3.22.0 is possible when the instance runs on a published legacy compatibility key because neither PERSISTENT_TOKENS_KEY nor metadata/persistent_tokens.key is present. An attacker must separately obtain the ciphertext-bearing account or configuration files (such as persistent_tokens.json, adminConfig.json, or the users file) before the known key can be used, so the medium CVSS 5.9 rating reflects high attack complexity and a narrow set of prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in 3.22.0.
Server-side request forgery in Portkey AI Gateway 1.14.0 through 1.15.2 lets unauthenticated remote attackers make the gateway issue requests to loopback and Docker host services and return the responses to the caller. The flaw exists because the isValidCustomHost check trusts localhost-style hostnames whenever the TRUSTED_CUSTOM_HOSTS environment variable is unset, which is the default configuration; an attacker only needs to send a /v1 request carrying a crafted x-portkey-custom-host header (for example via the ollama provider). Publicly available exploit code exists for this issue and it is not listed in CISA KEV, so exploitation activity is not confirmed; the assessed impact is limited to confidentiality and integrity of services reachable from the gateway host, with no availability or code-execution impact.
Manifest and blob digest verification bypass in the CNCF Distribution registry client (all versions prior to 3.1.2) lets an attacker who controls the registry HTTP response - by operating a malicious or compromised registry, or by holding a TLS-intercepting man-in-the-middle position - substitute attacker-chosen manifest content even when the caller pinned the request by digest, with the forged Docker-Content-Digest header presented as the requested value. The flaw is unauthenticated from the client's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N, 6.8) and scopes out of the client because the bundled pull-through proxy (registry/proxy/proxymanifeststore.go) can cache and re-serve the substituted manifest to downstream consumers, making this a conditional supply-chain integrity issue rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.1.2.
FrankenPHP's official Debian and Alpine Docker images prior to 1.12.5 ship a placeholder /app/public/index.php that executes phpinfo(), so any derived image that never replaced that file serves a full diagnostics page from its web root; a single unauthenticated HTTP GET (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) discloses environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and filesystem paths. The precondition is narrow and non-default: only containers built from those official base images and left with the untouched placeholder are exposed, while deployments that supply their own /app/public/index.php per the documented pattern are not affected. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the fix is a simple base-image bump to 1.12.5 plus a rebuild of every derived image, since existing derived images keep the placeholder even after the upstream fix.
Blind server-side request forgery in Crawl4AI before 0.9.4 lets unauthenticated remote attackers bypass Docker egress controls via the RobotsParser.can_fetch robots.txt fetch path, using HTTP redirects or DNS rebinding to reach loopback, internal, and cloud-metadata addresses for service discovery. Rated CVSS 4.0 6.9 (Medium), exploitation requires the check_robots_txt behavior to be in effect when the service processes an attacker-influenced target URL, which makes the Docker service being reachable by untrusted callers a precondition. The SSRF is blind, so responses are not returned to the attacker, keeping confidentiality impact low; no public exploit code or confirmed active exploitation was identified at time of analysis.
Hard-coded git credentials embedded in the distributed Docker image of FunnyWolf Viper up to and including version 3.1.11 are recoverable from the file /root/viper/.git/config, granting whoever obtains the image - or reaches a deployment that exposes the .git directory - access to the secrets stored there. Publicly available exploit code exists, published alongside a GitHub advisory and a VulDB submission, so the technique is trivially reproducible; there is no CISA KEV entry, so confirmed active exploitation in the wild is not established. With CVSS 4.0 scoring 5.5 (AV:N/PR:N/UI:N) but only LOW confidentiality impact and no integrity or availability effect, this is best treated as a low-to-moderate credential-disclosure issue rather than a pre-authentication remote compromise.
Docker Sandboxes can forward an unrecognized client-supplied credential in an alternate authentication header alongside the credential injected by the host egress proxy, potentially authenticating an outbound request to an attacker-controlled upstream account and exposing data included in that request. The proxy scrubs alternate credentials only when their values match known sentinel values, so untrusted code already running inside an authorized sandbox can bypass that removal if the targeted upstream service accepts another supported auth header. This is a local, moderate-severity confidentiality issue requiring sandbox code execution and credential injection to be enabled; no public exploit identified at time of analysis.
Docker Sandboxes credential-injection proxies can fail open and expose host-managed credentials - OAuth access and refresh tokens and a derived Anthropic API key - to code already running inside an authorized sandbox, defeating the masking control that is meant to keep those secrets outside the sandbox boundary. Exploitation requires an attacker to already have code executing in a sandbox configured to proxy host-managed credentials (PR:L) and depends on an edge condition where a proxied response-body read returns data together with an error, causing affected handlers to forward unmasked bytes instead of redacting them; because that error-plus-data condition is not guaranteed on every request (AT:P), reliability is limited and sandboxes that do not use credential injection are not affected. The vendor CVSS 4.0 base score is 5.9 and our independent assessment is CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:N/C:H/I:N/A:N; no public exploit code or CISA KEV entry was identified at the time of analysis, and the primary limiting factor on real-world risk is that the attacker must operate from within the sandbox trust boundary.
Docker Sandboxes can expose host-managed OAuth access and refresh tokens to untrusted code inside a sandbox when the managed-credential injection feature is in use and a user actively completes the OAuth authorization flow. A case-sensitivity mismatch in token-endpoint hostname masking (CWE-178) lets malicious code request a case-variant hostname that reaches the genuine provider while bypassing response masking; exploitation requires local code execution inside the sandbox plus user interaction, not a remotely exploitable, no-interaction attack. No public exploit identified at time of analysis, and no KEV or EPSS data is provided; the independent assessment rates this as a moderate-priority confidentiality issue rather than a high-urgency emergency.
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Docker volume by submitting a small single-stream compressed file (e.g., .gz, .bz2, .xz, .lzma, .lz) that decompresses to an effectively unbounded size. The flaw, CWE-409 decompression bomb, bypasses the entry-count, nesting-depth, and uncompressed-byte limits that scripts/safe-extract.py applies only to container archives (zip/tar/rar/7z via libarchive), causing disk exhaustion that disrupts OpenSearch, Logstash, Arkime, and Zeek for all users. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation requires valid credentials with upload permissions and results in availability impact only (CVSS 6.5).
Cross-organization repository metadata disclosure in the Katello (Red Hat Satellite 6) Docker Tags repositories API allows an authenticated user who holds product-view permissions in one organization to retrieve repository configuration data for Docker meta tags owned by a different organization by simply supplying that foreign tag identifier. The weakness is an authorization-scoping gap (CWE-639, IDOR-style) correctly rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with impact limited to low-severity confidentiality loss - there is no write or denial-of-service effect. Exploitation requires valid credentials, multi-organization deployment, and knowledge or enumeration of valid foreign tag identifiers; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not supplied.
Information disclosure and entitlement bypass in Docker Buildx Bake allows an attacker-supplied Bake definition to read files that should have required an explicit fs.read entitlement approval. An unauthenticated attacker can craft a definition that exposes a readable file via a pathless secret whose ID is interpreted as a client-side pathname, or that consumes a local OCI image layout outside the project because entitlement validation checks a different path representation than the one actually used. Exploitation requires the victim to run an untrusted Bake definition (CVSS 4.0 AV:N/AC:L/PR:N/UI:A, assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), impact is read-only with no code execution, write, or availability loss, and no public exploit has been identified at time of analysis; environments that build only their own trusted first-party Bake definitions are not exposed. This is a genuine but moderate-priority entitlement-bypass issue rather than a critical remote threat.
Laradock through 20.4 fetches code during its workspace Dockerfile build without verifying integrity, allowing a network-positioned attacker to substitute or intercept that download and influence the build with limited confidentiality, integrity, and availability impact. Exploitation requires a user to actively start the build (UI:P) and is rated high complexity, and while publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV). The issue is low priority given the network-positioning prerequisite, build-time-only window, and limited impact.
Missing authentication on AiSOC's response-action API endpoints lets adjacent-network attackers reach the actions service without credentials in versions 9.0.0 through 11.x when the shipped defaults are in use - AISOC_DEV_MODE enabled and AISOC_ACTIONS_SERVICE_TOKEN left empty. In that state the authorization guard in services/actions/app/security/authz.py exempts itself, so every mutating route answers unauthenticated, allowing an attacker to enumerate response-action integrations, submit and approve actions as arbitrary principals, and trigger host-isolation or account-disable containment actions through the platform's own vendor credentials. Exploitation is deployment-gated rather than universal: it requires network reachability to the actions-service port (adjacent/internal), and no public exploit code was identified at time of analysis. Vendor patching is available in AiSOC v12.0.0.
heym before 0.0.105 fails to enforce credential authorization in its Redis workflow node, letting an authenticated workflow author cause the node to fall back to unauthenticated defaults on the backend's loopback interface. When the credential lookup returns no accessible credential - because the ID does not exist, was deleted, or belongs to another user - the node treats the failure as empty configuration and connects to localhost:6379 with no password, executing the requested Redis operation there. The impact is deployment-gated: the stock docker-compose.yml ships no Redis, so default installs only surface a misleading connection error, while operators who have placed a passwordless Redis on loopback face unauthorized read/write access; no public exploit has been identified at time of analysis and no EPSS or KEV signal is available.
AzuraCast deployments before 0.23.8 expose a server-side request forgery and local file read flaw in the AutoDJ remote playlist fetcher, letting an authenticated user who holds the station Media permission point a remote_url playlist at a file:// path or an internal/loopback HTTP endpoint and have the backend fetch it with file_get_contents(). The retrieved lines are stored as queue entries and then disclosed through GET /api/station/{station_id}/queue to any user with the Broadcasting permission, exposing host files readable by the web container (such as /etc/passwd or the application .env) and the bodies of non-blind internal HTTP requests. Exploitation is bounded by valid low-privilege authentication and by the privileges of the web container, and no public exploit code was identified at time of analysis; the advisory data states that no patched version was available at publication, so mitigation depends on disabling PHP allow_url_fopen or tightening Media-permission access.
Label-filter isolation in Dozzle 10.6.5 and earlier is bypassed through the SSE events endpoint (GET /api/events/stream), so any authenticated user - including one explicitly constrained by a users.yml 'filter:' label to a single container scope - receives live CPU/memory/network/disk telemetry and lifecycle metadata for every container on every monitored host. The flaw requires authorization to be enabled (e.g. DOZZLE_AUTH_PROVIDER=simple) and at least one account using per-user label filters, which is the standard multi-tenant or environment-segregated configuration; the attack needs only valid credentials (PR:L) and no special shell/actions/download role or victim interaction. Impact is bounded to metadata and telemetry (container name, image, full label map, and resource counters) rather than log contents, environment variables, or exec/attach capability, which is consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N rating of 4.3 (CWE-200). A lab-only proof-of-concept script is published in the vendor advisory demonstrating the leak; there is no evidence of active exploitation (not in CISA KEV).
Stored cross-site scripting in REDAXO CMS 5.x (affecting versions up to and including 5.21.1) lets an authenticated backend administrator plant HTML/JavaScript in a Media Manager effect type's name field, which is later rendered unescaped inside the 'media is in use' warning shown when another administrator tries to delete a referenced media file. Successful exploitation requires a second, victim administrator to click the Delete button on a specifically referenced media item, after which the payload runs in the victim's backend session and can be used for session hijacking, credential harvesting, or CSRF-token theft leading to full backend account takeover. Rated CVSS 3.1 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), this is a low-priority issue: it is not listed in CISA KEV and there is no evidence of active exploitation, though the vendor advisory publishes a full step-by-step proof-of-concept reproduction (publicly available exploit code exists). No EPSS score or in-the-wild telemetry was provided with this report.
Self-hosted draw.io deployments running the Docker or WAR build prior to 30.2.7 can have a victim's browser session silently bound to the attacker's own cloud-storage identity, because the OAuth callback handler skips verification of the state token against the session cookie whenever IS_GAE is false. An attacker who completes a legitimate authorization for their own account can then induce a victim to open a crafted callback URL, causing subsequent Google Drive, OneDrive, GitHub, GitLab, or Dropbox actions to be performed under the attacker's identity (CVSS 4.2, CVSS:3.1/AV:N/AC:H/PR:N/UI:R, CWE-352); the impact is session integrity loss and misattribution rather than disclosure of the victim's existing cloud files, and no public exploit identified at time of analysis. The hosted SaaS at app.diagrams.net and any Google App Engine build set IS_GAE=true and are unaffected.
Denial of service in the Thinkst Canary honeypot's optional Redis service can be triggered by unauthenticated remote attackers when that service is enabled, causing limited availability impact to the Redis service without confidentiality or integrity loss. The Canary is not affected if Redis is disabled, and the high attack-complexity score reflects that the trigger requires specific conditions rather than a reliable full-appliance outage. Thinkst has addressed the issue across supported platforms and published a patched Docker image, with automatic updates already in distribution; no public exploit identified at time of analysis.
Path traversal in rclone's Docker volume plugin ('rclone serve docker', versions 1.56.0 through 1.75.0) lets an attacker who can submit a VolumeDriver.Create request to the plugin socket make the privileged rclone process create a directory and mount an attacker-specified remote filesystem at an arbitrary host path. The attacker must already be in a high-privileged, socket-scoped position (PR:H) - normally the Docker daemon itself or, in a multi-tenant orchestration environment, a workload allowed to request named volumes - and no user interaction is required. Impact is bounded to unauthorized directory creation and remote-filesystem mounting over host paths rather than arbitrary code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in 1.75.1.
Let me synthesize. CVE-2026-91942: crawl4ai before 0.9.3, DOM-based XSS in Docker Playground UI, innerHTML assignment of untrusted crawl results. Malicious PDFs with event-handler markup execute JS in Playground origin, steal API tokens from sessionStorage. CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N — score 5.1. UI:A means user interaction active (user must open the PDF in the playground). Subsequent system impacts limited (SC:L/SI:L). PR:N unauthenticated. Wait — description says "steal API tokens from sessionStorage for authenticated API abuse" — the attacker themselves may be unauthenticated but the victim is an authenticated user. PR:N with UI:A. Let me construct fields. product_name: "Crawl4AI" (2 words? one token). Fine. prevalence: crawl4ai is a popular open-source LLM-friendly web crawler — medium? It's fairly widely used in AI/RAG pipelines. It's a Python library with ~40k GitHub stars. Deployment footprint: medium. Docker Playground UI is a specific deployment mode though — that reduces. I'd say "medium" with basis "popular open-source LLM crawler; Playground UI subset narrower". Hmm, but the specific vulnerable component (Docker Playground UI) is niche. But prevalence is about the product. crawl4ai is popular open-source library. Medium seems fair. assessed_cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — scope changed because it impacts the Playground origin / API tokens (sessionStorage tokens, the script executes in the Playground origin). Actually the CVSS 4.0 vector shows SC:L/SI:L which implies subsequent system impacts → in 3.1 that maps to S:C with C:L/I:L. Hmm, but is scope change right? The vulnerable component is the Playground UI; the impacted component is... the API tokens / authenticated API. The XSS executes in the Playground origin — same origin. Stealing sessionStorage tokens then abusing the API — the API is arguably a different security authority. Given the CVSS 4.0 has subsequent-sys
OCI artifact signature verification bypass in Doco-CD prior to v0.90.1 allows an attacker with write access to a monitored OCI registry tag to circumvent the global OCI_TRUST_POLICY enforcement and deploy unsigned or improperly signed artifacts. By publishing an artifact containing a crafted .doco-cd.yml with oci.verify: false, the attacker exploits a circular trust dependency - the tool reads per-deployment config from artifact contents before verifying that artifact - causing signature checking to be disabled for that same artifact. The vendor-released patch at v0.90.1 enforces a strict no-downgrade trust boundary; no public exploit has been identified at time of analysis.
Unauthenticated access to Mousehole's HTTP/WebSocket management interface (port 5010) exposes the stored MyAnonamouse (MAM) session cookie to any network peer in versions prior to 0.4.0. The service serializes its internal state - including the live MAM session cookie - identically across persisted storage, public API responses, and WebSocket push updates, meaning a passive read of any endpoint yields the credential. An attacker who can reach port 5010 can additionally overwrite the stored cookie and trigger MAM IP-update side effects, turning a disclosure into account manipulation. No public exploit code has been identified at time of analysis.
Renovate's `minimumReleaseAge` supply-chain defense control is not enforced for digest-type dependency updates, allowing a newly published - potentially malicious - package digest to immediately trigger a pull request and CI pipeline execution before the configured stability waiting period elapses. All Renovate versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0 are affected when repositories combine the `minimumReleaseAge` setting with digest-pinned dependencies such as GitHub Actions commit SHAs, Docker images, Go modules, or NuGet packages. No public exploit has been identified at time of analysis, but the flaw directly undermines an intentionally configured supply-chain defense, making it high-priority for organizations that depend on this control.
Stored cross-site scripting in the Venueless default Docker image allows a low-privileged authenticated user to upload an SVG file containing executable JavaScript, which executes in the browser of any user who subsequently views the file. The root cause is absent Content Security Policy enforcement combined with unfiltered SVG delivery, classified as CWE-80. The vendor addressed this by adding a valid CSP to the default image; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Uprobe-based gadget attachment in Inspektor Gadget (versions >= 0.27.0, < 0.53.1) can be weaponized by any unprivileged container to cause approximately 53 seconds of CPU burn in the IG daemon by supplying a crafted `/etc/ld.so.cache` file - no container capabilities required. Because IG uses fanotify hooks to pause container startup until uprobe attachment completes, and Docker serializes container starts behind that pause, a single crafted container effectively blocks all other containers on the host from launching for the duration of processing. The attack is amplifiable by starting multiple crafted containers simultaneously, and no public exploit has been identified at time of analysis.
Environment variable exposure in Renovate (versions 42.68.1 through 42.96.3 and 43.0.0 through 43.4.4) leaks the full process environment - including privileged credentials - into every child process spawned during dependency update operations. The regression was introduced inadvertently on 2025-12-30 when Renovate migrated to the `execa` library, whose default behavior extends rather than replaces environment variables, silently bypassing Renovate's intended allowlist filtering. Both insider attackers (with repository write access) and outsider attackers (via supply-chain compromise of a processed dependency) can embed credential-harvesting code in scripts that Renovate executes, exfiltrating GitHub tokens, registry credentials, and cloud IAM keys accessible to the deployment. No public exploit has been identified at time of analysis, but the vendor explicitly recommends rotating all credentials that affected Renovate instances had access to.
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
Remote code execution in UpTrain 0.7.1 and prior allows authenticated users to execute arbitrary commands on the host system via the `/new_run` API endpoint. The `checks` and `metadata` parameters are unsanitized, enabling injection attacks (CWE-74) that run in the context of the underlying process - typically a Docker container per the official deployment documentation. Publicly available exploit code exists (CVSS 4.0 E:P per GitHub Security Lab advisory GHSL-2024-200/201), and no vendor-released patch has been identified at time of publication.
Remote code execution in UpTrain's `/add_prompts` API endpoint allows any authenticated user to execute arbitrary commands on the host system by injecting malicious payloads into the `checks` or `metadata` parameters. Affected versions are 0.7.1 and prior, and deployments following the official documentation run inside Docker containers, meaning successful exploitation grants control of the container environment. GitHub Security Lab (GHSL-2024-200/201) has published an advisory and the CVSS 4.0 E:P modifier confirms publicly available proof-of-concept exploit code exists; no vendor-released patch has been issued as of time of publication.
Remote code execution in UpTrain v0.7.1 and prior is achievable by any authenticated user through the `/create_project` API endpoint, where the `checks` and `metadata` parameters are processed without adequate sanitization, allowing arbitrary code to run in the context of the host process. Discovered and reported by GitHub Security Lab (GHSL-2024-198/GHSL-2024-199), the flaw targets the dashboard backend (app.py:L691) and is most commonly exploited within Docker-based deployments as recommended by official documentation. No vendor patch exists as of publication, and a proof-of-concept is confirmed by the CVSS 4.0 E:P modifier, elevating real-world urgency despite the authentication prerequisite.
Predictable temporary file paths in Etherpad's import and export handlers expose multi-tenant deployments to a symlink-based file overwrite attack. All ep_etherpad-lite versions through v3.0.0 are affected; exploitation requires local host access, an unprivileged OS account, and - for high-impact scenarios - the Etherpad process running as root, a common default in many Docker base images. A proof-of-concept sketch is included in the vendor advisory GHSA-2jwf-f4xq-f24h; no public weaponized exploit code beyond that sketch exists and this vulnerability is not listed in the CISA KEV catalog.
Docker Sandboxes (sbx) fails to enforce read-only semantics on virtio-fs host mounts: the in-guest bind correctly receives the read-only flag, but the underlying host-edge grant omitted from the policy-share allowlist carries no access mode, leaving the shared-export path fully writable at the host level. Low-privileged code executing inside the sandbox can enumerate or derive the virtio-fs export path and write to host directories the operator explicitly attached as read-only, breaking the isolation guarantee that is the product's core security promise. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Dozzle's webhook SSRF guard can be bypassed by authenticated users in versions 10.5.2 through 10.6.14 by supplying webhook URLs that resolve to IPv6 transition addresses encoding blocked IPv4 targets such as 127.0.0.1 or 169.254.169.254. The `isBlockedIP` function in `internal/notification/dispatcher/webhook.go` validated literal IPv4 and native IPv6 addresses but did not unwrap IPv4 addresses embedded inside 6to4, NAT64, Teredo, or IPv4-compatible IPv6 forms, making the guard trivially circumvented by encoding a loopback or link-local address in any of those transition formats. The CVSS 4.0 score is 2.3; publicly available exploit code exists per SSVC classification, though no active exploitation has been confirmed and the vulnerability is not in CISA KEV.
Command injection in Dokploy's Docker build pipeline allows authenticated application editors to execute arbitrary OS commands on the Dokploy host by supplying shell metacharacters in the dockerContextPath build configuration field. The malicious path value flows from the dashboard UI through getDockerContextPath() directly into an unquoted cd shell command executed via execAsync, enabling full host-level code execution under the Dokploy server process. All Dokploy installations prior to version 0.29.13 are affected; no active exploitation or public exploit code has been identified at time of analysis, though exploitation requires only a low-privilege authenticated session.
Command injection in Dokploy's `createCommand()` function allows authenticated users with compose deployment access to execute arbitrary OS commands on the underlying Docker host. All Dokploy releases before 0.29.13 are affected via CPE cpe:2.3:a:dokploy:dokploy:*. The official CVSS score of 6.5 with C:H/I:N/A:N materially understates actual impact - successful exploitation yields full host-level command execution, not merely information disclosure. No public exploit identified at time of analysis, though working injection payloads are published directly in the fix commit's test suite.
Traefik's BasicAuth middleware in versions 3.6.11-3.6.24 and 3.7.0-3.7.9 permits an authenticated low-privilege user to forge arbitrary backend identities via a singleflight key collision race condition. By concatenating their known valid password with a retrieved stored bcrypt hash, an attacker crafts a singleflight deduplication key identical to a legitimate in-flight request's key; the middleware returns the legitimate request's successful authentication result to the attacker's request, then propagates the attacker's chosen unconfigured username to the backend as a trusted identity. A fully working proof-of-concept achieving 25-of-25 successful identity forgeries under default bcrypt cost is publicly available in the GitHub security advisory; no CISA KEV listing has been identified at time of analysis.
Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-privilege attacker to poison Docker and Fly.io setup commands displayed in the web interface, causing arbitrary shell code to execute on the machine of any user who copies and runs the generated command. Affected versions span 0.13.0 through 0.18.6 and 0.19.0 through 0.19.8. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 4.9 reflects the high privileges required and the indirect execution path through a secondary user's action.
Stored cross-site scripting in Ghost CMS feature image captions enables any authenticated staff user to inject unsanitized HTML into the post revision history modal, hijacking the Ghost Admin session of another staff or administrator user who views that revision. Affects Ghost npm package versions v4.9.0 through v6.54.0. No public exploit identified at time of analysis and not listed in CISA KEV, but the privilege escalation potential - a lower-privileged staff member compromising a full administrator session - makes this higher-impact than the CVSS 4.3 score implies for multi-tenant or shared Ghost Admin environments.
Server-Side Request Forgery in Ghost CMS v6.26.0-v6.54.0 allows unauthenticated remote attackers to abuse features such as Webmentions to issue blind HTTP requests from the Ghost server into its internal network, bypassing perimeter controls without returning response content to the attacker. The flaw stems from insufficient URL validation in outbound HTTP request handling, enabling internal host probing across a changed security scope (CVSS S:C). No active exploitation (CISA KEV) or public POC has been identified at time of analysis; the vendor has released a fix in v6.54.1.
Session fixation in Ghost Admin (v2.2.0-v6.54.0) allows an attacker who can plant a known session identifier in a victim's browser - via a secondary vulnerability on the same domain - to hijack an authenticated Ghost Admin session after the victim logs in. The root cause is that Ghost Admin's login flow did not call session regeneration, leaving the pre-login session ID valid post-authentication. Exploitation is chained and non-trivial, but the upstream fix (v6.54.1) is confirmed and straightforward to apply. No public exploit code and no CISA KEV listing identified at time of analysis.
Path traversal in Ghost CMS theme upload (CWE-22) allows an authenticated staff-level user to write arbitrary files outside the designated uploads directory, potentially altering the behavior of the entire Ghost installation. Affected versions span v0.10.0 through v6.54.0 of the npm/ghost package - a wide range covering essentially all modern deployments. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS Scope:Changed metric reflects that a successful write can affect components beyond the theme storage boundary, elevating the real-world impact above the moderate base score suggests.
Path traversal in Ghost's database backup export endpoint allows Administrator-level users to remotely overwrite arbitrary files on the server filesystem, affecting all Ghost installations from version 1.20.1 through v6.54.0 (npm package pkg:npm/ghost). An authenticated admin can supply a crafted export filename containing path separators (e.g., '../../etc/crontab') when triggering a database export, causing Ghost to write the JSON export blob outside the intended directory to an attacker-controlled path. No public exploit code exists and this CVE does not appear in CISA KEV at the time of analysis; however, the CVSS Scope:Changed rating reflects that successful exploitation crosses the application's filesystem boundary, with integrity and availability consequences beyond Ghost's own data directory.
Blind SSRF in Ghost Admin's image-size fetching module allows any authenticated staff-level user to issue arbitrary HTTP GET requests from the Ghost server to internal network hosts. Affecting all Ghost npm releases from v0.10.0 through v6.54.0, the flaw resided in the image dimension detection code path, which used an unprotected generic HTTP client with no SSRF controls when fetching external images for certain formats requiring a full response buffer. No public exploit or CISA KEV listing exists; no EPSS data was provided. The vulnerability was fixed in v6.54.1 by routing fetches through Ghost's SSRF-protected `externalRequest` got-based client.
Ghost CMS subscription checkout accepts redemption of archived offers due to missing offer-status validation in the member router controller, affecting all self-hosted Ghost instances from v4.22.0 through v6.54.0. Unauthenticated users who possess or can discover an archived offer ID can submit a valid checkout request and obtain unauthorized subscription discounts or access at a revoked price point. No public exploit code has been identified and this CVE is absent from CISA KEV, but the direct financial impact on subscription-based Ghost sites makes it a meaningful business-logic risk for affected operators.
Null byte injection in the free5GC Authentication Server Function (AUSF) v4.2.1 and earlier allows unauthenticated remote attackers to crash Go's URL parser and force HTTP 500 responses on the authentication endpoint, denying authentication service to all legitimate 5G subscribers sharing that AUSF instance. A publicly available Python PoC is included in the vendor's own security advisory, and fuzzing demonstrated a 4.1% trigger rate across nearly 100,000 requests - confirming reliable, scalable exploitation against the default deployment with no special configuration required. No public exploit or CISA KEV listing is confirmed at time of analysis, but the trivially automatable nature of the attack makes it a material risk for 5G core operators.
Authentication bypass in Cosmos-Server 0.22.18 and earlier allows any holder of a valid Constellation device API key to impersonate any user (including admin) to backend applications by sending crafted x-cosmos-user headers. The tokenMiddleware prematurely returns before stripping these headers when the request originates from the Constellation tunnel, bypassing JWT authentication, MFA, and the AdminOnly access gate. Publicly available exploit code exists but no active exploitation has been reported.
Remote unauthenticated denial of service in gopacket <= 1.6.0 via a single crafted sFlow UDP datagram that triggers an unbounded memory allocation of up to 16 GiB, causing the parsing process to be OOM-killed. Affected services include any network telemetry collector or application that uses gopacket’s sFlow decoder without additional validation. A proof-of-concept exploit exists and can crash the process with just a 104-byte packet.
Remote denial-of-service in the gopacket library's Diameter AVP decoder allows unauthenticated attackers to trigger a ~4 GiB memory allocation per crafted packet, causing OOM kill after two messages under memory constraints. The flaw affects gopacket ≤1.6.0 (latest before fix), and publicly available exploit code demonstrates end-to-end exploitation against a collector with a 256 MB memory cap. No active exploitation is currently reported.
OS command injection in localstack serverless-localstack up to version 1.4.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `custom.localstack.docker.compose_file` configuration argument processed by the Configuration Handler in `src/index.js`. A publicly available proof-of-concept exploit exists via GitHub issue #303, elevating practical risk beyond the moderate CVSS 4.0 base score of 4.8. No vendor patch has been released, as the project maintainer has not responded to the responsible disclosure reported through an issue report.
Remote denial-of-service in Gitea versions prior to 1.27.0 allows any authenticated user to crash the server by exploiting an O(N²) string concatenation flaw in the RFC 4716 SSH key parser. Submitting a single crafted SSH2 public key with hundreds of thousands of short content lines forces quadratic heap allocation that exhausts CPU and RAM within seconds, taking the entire Gitea instance offline. A functional, Docker-packaged proof-of-concept is publicly available per the Gitea security advisory; no active exploitation has been confirmed in CISA KEV, but the trivially low barrier - any valid user account suffices - elevates real-world risk considerably.
LFS deploy-key privilege escalation in Gitea (< 1.27.0) allows a holder of a write deploy key for any single repository owned by a victim to exfiltrate LFS objects from all private repositories that victim owns. The flaw originates in `routers/private/serv.go:275`, where Gitea embeds `repo.OwnerID` as the JWT `UserID` for deploy-key SSH sessions, causing the LFS batch handler at `services/lfs/server.go:268` to evaluate cross-repository authorization as if the repository owner - not the deploy key - were the requesting principal. If the victim is a Gitea site administrator, an unfiltered query in `models/git/lfs.go:226` exposes every LFS object on the entire instance. A public end-to-end PoC (poc.sh) is attached to the GitHub advisory; no CISA KEV listing exists at time of analysis.
RSS/Atom feed handlers in Gitea prior to v1.27.0 expose private repository content - commit metadata, release notes, tag names, and cross-repo activity streams - to holders of confined API tokens that are explicitly blocked from the same data via download routes. The bypass breaks the token-confinement guarantee introduced by PR #37698 for raw/archive/download handlers, which was never extended to the sibling feed endpoints despite those endpoints accepting identical token-based Basic auth. A working proof-of-concept is documented in the GHSA advisory verified against the official gitea/gitea:1.26.2 Docker image; the vulnerability is not confirmed in CISA KEV, and the primary realistic threat is a leaked or lower-trust token used in CI or third-party integrations circumventing its intended scope restrictions.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Token scope enforcement is bypassed on Gitea's repository home page handler (`repo.Home`), exposing private repository README, root file/directory tree, description, language statistics, license, and latest-release data to any authenticated PAT or OAuth2 token that lacks the `repository` scope or is marked `public-only`. This is the third in a series of related incomplete fixes - CVE-2026-20706 and CVE-2026-27761 patched sibling routes (archive download and RSS/Atom feeds) but the home route was overlooked, leaving it without the `CheckRepoScopedToken` guard applied to every neighboring handler. Publicly available exploit code exists in the form of a self-contained Docker-based proof-of-concept published in the vendor advisory; no active exploitation has been confirmed by CISA KEV.
Denial of service in Gitea's Debian package registry (all versions before 1.27.0) lets any authenticated user with package write access crash the server with a single .deb upload. The parser's ParseControlFile decompresses control.tar.gz with no size limit and tees the entire stream into a strings.Builder, so an 83 MB payload expands to 16+ GB and exhausts memory; a companion O(N²) string concatenation on Description continuation lines can independently saturate a CPU core. A complete working proof-of-concept is published in the advisory, so publicly available exploit code exists, though there is no public exploit identified as used in active attacks and the issue is not in CISA KEV.
OAuth token introspection in Gitea prior to v1.27.0 discloses token metadata - including active status, scope, username, and JWT registered claims - to any authenticated OAuth client regardless of whether that client is the token's intended audience, violating RFC 7662 section 4. Any registered OAuth application on the target instance can call `/login/oauth/introspect` with a token issued to a completely different client and receive a valid response. No public exploit is confirmed in CISA KEV, but a complete proof-of-concept reproduction script (`poc.sh`) is publicly attached to the GHSA advisory, making exploitation trivially reproducible by anyone with a registered OAuth client credential.
File Browser's share API (confirmed vulnerable through v2.63.16) leaks bcrypt password hashes and bypass tokens for password-protected shares via unfiltered JSON serialization of the internal `Link` storage struct. Authenticated users receive these secrets for their own shares on every create or list call, while administrators calling `GET /api/shares` obtain the password hash and bypass token for every user's shares across the entire instance. A working proof-of-concept is publicly available against the v2.63.15 Docker image; the exposed bypass token grants direct, password-free access to any protected share without cracking, while the bcrypt hash enables offline recovery of reused credentials.
Unauthenticated path traversal in Nuclio Dashboard's function build API allows arbitrary file write as root inside the Dashboard container. The `spec.handler` field accepts unsanitized module names containing `../` sequences, which Go's `path.Join`/`path.Clean` resolves to escape the build temp directory; the resulting path is passed to `os.WriteFile` running as `uid=0`. Versions up to and including 1.15.27 are affected; a full working proof-of-concept has been publicly disclosed, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Uncontrolled memory allocation in Envoy Gateway's OCI image fetcher allows a low-privileged tenant to crash-loop the shared controller cluster-wide. Versions before 1.7.4 and in the 1.8.x pre-release range before 1.8.1 are affected. By submitting an EnvoyExtensionPolicy referencing a malicious OCI registry serving a tar layer with a PAX/GNU-encoded multi-terabyte header size, an attacker triggers an unrecoverable Go runtime OOM in the controller - a single-request, non-volumetric, persistent denial of service that persists across restarts until the CRD is manually deleted. No public exploit identified at time of analysis.
Authenticated blind SSRF in Koel v9.6.0 allows any logged-in user to trigger server-side HTTP requests to private, loopback, and RFC1918 destinations by exploiting a missing SafeUrl validation guard on the Subsonic-compatible createPodcastChannel.view route. The main podcast API correctly rejects private URLs with a 422 error, but the Subsonic compatibility layer omits the same SafeUrl rule, and the attacker-supplied URL is fetched synchronously during channel creation via Poddle::fromUrl() - no separate step required. No public exploit identified at time of analysis per KEV status, but a fully documented public PoC with step-by-step curl commands is available in GHSA-w79m-f3jx-779v, validated against the official phanan/koel:9.6.0 Docker image.
Path traversal in psd-tools through v1.17.0 exposes any application processing untrusted PSD files to arbitrary file write and secondary arbitrary file read via the SmartObject API. SmartObject.save() consumes the embedded smart-object filename verbatim from the PSD binary - without basename stripping, absolute-path rejection, or directory-escape filtering - allowing a crafted PSD to write attacker-supplied bytes to any path the process can reach. A secondary issue in SmartObject.open() for external-kind objects uses the attacker-controlled fullPath descriptor as a read source, enabling file exfiltration to the write destination. A standalone proof-of-concept is publicly confirmed in the advisory; the fix is vendor-confirmed in v1.17.1 (PR #657). No public exploit identified at time of analysis beyond the advisory-embedded POC, and no CISA KEV listing was found.
Credential file exfiltration in SiYuan prior to 3.7.1 is possible through the POST /api/file/globalCopyFiles endpoint, which accepts arbitrary absolute source paths and relies on an incomplete denylist in util.IsSensitivePath to block sensitive files. The denylist omits common credential files including .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, enabling an authenticated administrator or API-token holder to copy these files into the workspace and read them via the file API. No public exploit code or CISA KEV listing exists at time of analysis, but the Docker tag suggests this is relevant in containerized deployments where host-mounted credential files may be accessible.
Unauthenticated access to the self-hosted HTTP transport of DeepSeek MCP Server (versions 1.4.2-1.7.x) allows any network-reachable client to initialize a valid MCP session, enumerate server tools, and invoke them without credentials - including `deepseek_chat`, which silently consumes the server operator's `DEEPSEEK_API_KEY`. Default Docker deployments expose port 3000 in HTTP mode out of the box, maximizing the attack surface for any container running on a network-accessible host. No public exploit has been identified at time of analysis, though the GitHub advisory references reproduced testing confirming the full bypass against commit `5e1302171e99`.
Open redirect in waku's `unstable_redirect()` server-side router helper allows a network attacker to redirect victims' browsers to arbitrary external domains - including phishing sites for credential harvesting and OAuth token theft - by injecting a malicious `location` string into any waku route that passes user-controlled query parameters to the function. The vulnerability affects waku 1.0.0-beta.0 across all supported runtime adapters (Node.js, Cloudflare Workers, Vercel Edge, Deno), as the reflection path in `handler.ts` is shared. A dynamic proof-of-concept was confirmed by the reporter in two independent Docker-based runs against commit 8e9f542; no vendor-released patch is confirmed at time of analysis, though a v1.0.0-beta.1 release tag appears in advisory references.
OS command injection in Coolify's database service configuration API allows authenticated administrators to execute arbitrary shell commands within Docker container contexts by embedding shell metacharacters into database credential fields. All Coolify versions prior to 4.0.0-beta.474 are affected, covering deployments managing Redis, KeyDB, Dragonfly, ClickHouse, PostgreSQL, and MySQL services. No public exploit code has been identified at time of analysis, and the CVSS PR:H requirement confines the attack surface to already-privileged admin accounts, positioning this as a post-compromise escalation risk rather than an initial access vector.
Stored cross-site scripting in Kiwi TCMS versions prior to 16.1 allows authenticated users to inject arbitrary JavaScript into the `TestCase.extra_link` and `TestPlan.extra_link` fields, which are rendered verbatim to all subsequent viewers. Official Docker-based deployments are substantially protected by a `Content-Security-Policy` header that blocks inline script execution, but customized deployments that alter default middleware or security settings remain fully exploitable. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
OS command injection in Coolify's settings module allows a highly privileged attacker in a development environment to execute arbitrary shell commands on the host server by injecting metacharacters into the dev_helper_version field, which is passed unsanitized into a Docker build command. All Coolify releases prior to 4.0.0-beta.474 are affected. No public exploit code exists and no CISA KEV listing has been issued; the provided CVSS score of 3.8 (Low) accurately reflects the highly constrained exploitation prerequisites, though the underlying command injection class warrants upgrade regardless.
Arbitrary file write as root via symlink attack in Linuxfabrik Monitoring Plugins affects any deployment using the provided sudoers configuration. The monitoring plugins create SQLite databases at predictable, static paths under /tmp; an attacker who has already gained access to the nagios service account can pre-place symlinks at those paths, and when a monitoring script is subsequently invoked via sudo, it follows the symlink and writes a SQLite database to any attacker-chosen path on the filesystem. A proof-of-concept is included in the GitHub Security Advisory GHSA-r35r-fpx2-jgr4, and no CISA KEV listing or CVSS score has been assigned at time of analysis.
Sandbox boundary enforcement failure in PentAGI (vxcontrol) versions up to 2.1.0 allows authenticated remote users to break Docker containment controls via the Docker API client component in `backend/pkg/docker/client.go`, enabling limited information disclosure and unauthorized low-impact modifications within the Docker environment. The CVSS 4.0 vector (PR:L, AV:N, AC:L) confirms low-privilege network-reachable exploitation with no user interaction required, though all impact metrics remain Low and no host-level breakout is indicated. No public exploit code exists and this vulnerability is not listed in CISA KEV; an upstream fix is pending as an unmerged GitHub pull request.
Unauthenticated OAuth client secret disclosure in Dragonfly Manager (dragonflyoss/dragonfly <= v2.4.3) exposes GitHub and Google OAuth client_secret values to any host that can reach the Manager REST API port. The GET /api/v1/oauth and GET /api/v1/oauth/:id handlers omit the jwt.MiddlewareFunc() and RBAC middleware enforced on every other admin route group in the same router file - including the write methods (POST, DELETE, PATCH) in the same /oauth group - and the models.Oauth struct serializes ClientSecret without redaction. A detailed proof-of-concept with captured output is included in the advisory; no CISA KEV listing is present and EPSS data is unavailable.
Unvalidated bearer realm URL handling in oras-go v2 ≤ 2.6.0 enables two distinct attack primitives against users who run oras operations against a malicious, compromised, or man-in-the-middle'd registry: server-side request forgery (SSRF) to internal network endpoints including cloud instance metadata services, and TLS downgrade that exposes user credentials in plaintext. The OCI distribution spec legitimately allows cross-host realm references for split-auth deployments (e.g., Docker Hub's auth.docker.io pattern), but oras-go failed to block private IP literals, loopback addresses, and scheme downgrades from https to http - patterns that are never legitimate under any valid registry trust model. No active exploitation has been confirmed (not in CISA KEV), and a patch is available in v2.6.1.
Memory exhaustion denial-of-service in Mailpit <= v1.30.0 allows unauthenticated remote attackers to consume excessive memory via unbounded JSON body on several API endpoints. An incomplete fix for a previous DoS leaves four sibling endpoints without size limits, enabling amplification of up to 28x RSS per request. Publicly available exploit code exists; EPSS indicates low exploitation probability (0.51%), but the vulnerability is easily exploited against default deployments.
Prototype pollution in @hey-api/openapi-ts affects all versions through 0.97.2, allowing remote unauthenticated attackers to substitute the prototype chain of the returned params slot object by passing a crafted key such as '$query___proto__' through any application that forwards user-supplied parameters to a generated SDK method. The flaw resides in a runtime template (dist/clients/core/params.ts) that is copied verbatim into every generated SDK, meaning every downstream npm package regenerated from this tool carries the vulnerable code - confirmed affected consumers include @opencode-ai/sdk and @trigger.dev/sdk. A functional proof-of-concept is publicly available; exploitation is not confirmed as actively exploited and is absent from CISA KEV.
Authentication bypass in Presenton's bundled MCP server exposes server and Docker deployments to unauthenticated remote exploitation via the unprotected /mcp endpoint. When operators configure session authentication using AUTH_USERNAME/AUTH_PASSWORD, nginx enforces access control on all paths except /mcp, which is absent from the auth_request gate - and the MCP server compounds this by auto-minting valid internal session tokens for the configured user on any incoming request. An unauthenticated remote attacker can therefore invoke MCP tools such as generate_presentation as if fully authenticated, consuming the operator's LLM API keys and writing arbitrary presentations to the instance. A publicly available proof-of-concept exists; no active exploitation confirmed in CISA KEV.
Command injection in Coolify prior to 4.0.0-beta.464 allows authenticated administrators to escape the Docker container and execute arbitrary commands on the host server. The vulnerability originates from the executeInDocker() helper that wraps commands in bash -c '{$command}' without escaping single quotes, enabling injection via user-controlled Docker compose fields. A proof-of-concept exploit exists, but no active exploitation is reported (EPSS 0.22%, low risk).
Credential exposure in turso-cli versions 1.0.25 and earlier allows any local user on the same host to read the Turso platform JWT stored world-readable at mode 0o644 in settings.json, granting full access to all Turso organizations the victim belongs to. The root cause is turso-cli's failure to override Viper's insecure default configPermissions before writing credentials - a deviation from the explicit 0o600 baseline established by comparable CLIs including gh, aws, docker, and gcloud. A proof-of-concept demonstrating the 0o644 mode is included in the advisory; no active exploitation is listed in CISA KEV.
Insufficiently protected credential storage in Dokku prior to 0.38.2 exposes git authentication secrets stored in $DOKKU_ROOT/.netrc to any local user who can traverse the Dokku home directory. The git:auth command pre-creates the .netrc file using bash's touch, which applies the process umask (0644) before the netrc binary runs - defeating the netrc binary's own 0600 enforcement because the file already exists at write time. No public exploit code exists and the vulnerability is not in CISA KEV, but the confidentiality impact is rated High given that plaintext git credentials (hostnames, usernames, passwords) are directly readable without any special tooling.
JWT algorithm confusion in Netflix Lemur 1.9.0 allows an attacker to control which signing algorithm the server trusts by supplying an arbitrary alg value in the unverified token header, which is passed directly to pyjwt.decode() instead of a server-pinned allowlist. On current PyJWT 2.x deployments the standalone impact is limited to audit-log blinding and a durable algorithm-downgrade primitive; full account takeover requires chaining with a separate LEMUR_TOKEN_SECRET disclosure vulnerability, after which a forged HS256 admin JWT yields HTTP 200 with role=admin. A public proof-of-concept walkthrough exists (asciinema); no active exploitation is confirmed in CISA KEV.
Stored XSS in the AWS API key store component of Thinkst Applied Research Canarytokens allows a low-privileged attacker who knows a token's random identifier to inject persistent malicious scripts that execute in a victim's browser when they view the affected token page. Exploitation is constrained by high attack complexity (AC:H), a prerequisite attack requirement (knowledge of a random identifier), low-privilege authentication, and active user interaction - reflected in an extremely low CVSS 4.0 base score of 1.1. No active exploitation is confirmed; however, the CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists.
Unauthenticated remote action execution in motionEye (pip/motioneye < 0.44.0) exposes every camera action endpoint - snapshots, recording start/stop, and administrator-configured shell scripts - to any attacker who can reach port 8765, due to a missing @BaseHandler.auth() decorator on ActionHandler.post(). Dynamically confirmed on v0.43.1 in a Docker lab environment; exploitation requires only a single HTTP POST with no credentials, headers, or user interaction. Beyond the CVSS 5.3 Medium rating, real-world impact extends to physical security bypass (PTZ, alarms, lighting controls) if action scripts are configured, and SSRF via remote camera triggering - no public exploit or CISA KEV listing is identified at time of analysis.