DO
Product
dokploy
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 37High 13Medium 9Low 0
Watch
Add dokploy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-72873 | 6.5 | Aug 10 | Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one` Affected: < 0.29.13 |
| CVE-2026-72739 | 6.5 | Aug 10 | Dokploy: Command Injection via Compose Shell Execution Affected: < 0.29.13 |
| CVE-2025-53375 | 6.5 | Jul 7 | Dokploy allows attackers to read any file that the Traefik process user can access Affected: < 0.23.7 |
| CVE-2026-72881 | 6.4 | Aug 10 | Dokploy: Command Injection via database credentials in backup/restore commands Affected: < 0.29.13 |
| CVE-2026-111331 | 6.3 | Oct 15 | Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router Affected: through 0.30.8 |
| CVE-2026-24839 | 6.1 | Jan 28 | Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers Affected: < 0.26.6 |
| CVE-2026-45791 | 5.9 | Aug 17 | Dokploy: Password Change Does Not Revoke Active Sessions Affected: < 0.29.6 |
| CVE-2026-43917 | 5.3 | May 29 | Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation Affected: <= 0.19.0 |
| CVE-2025-53374 | 4.3 | Jul 7 | Dokploy Improperly Discloses User Information via user.one Endpoint Affected: < 0.23.7 |
| CVE-2026-72885 | 0.0 | Aug 10 | Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder Affected: < 0.29.13 |