DO
Product
dokploy
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 37High 13Medium 9Low 0
Watch
Add dokploy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116068 New | 8.8 | Oct 25 | Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router Affected: through 0.30.10 |
| CVE-2026-72883 | 8.8 | Aug 10 | Dokploy: WebSocket Terminal Missing Service-Level Access Control Affected: < 0.29.13 |
| CVE-2026-72875 | 8.8 | Aug 10 | Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile Affected: < 0.29.13 |
| CVE-2026-72866 | 8.8 | Aug 10 | WebSocket Terminal Auth Bypass Affected: < 0.29.13 |
| CVE-2026-45662 | 8.8 | May 29 | Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion) Affected: <= 0.29.0 |
| CVE-2026-24840 | 8.8 | Jan 28 | Dokploy uses hardcoded credentials in installation script, which could result in database access Affected: < 0.26.6 |
| CVE-2025-53376 | 8.8 | Jul 7 | Dokploy allows attackers to run arbitrary OS commands on the Dokploy host. Affected: < 0.23.7 |
| CVE-2026-72884 | 8.7 | Aug 10 | Dokploy: Command Injection via Compose Custom Command Affected: < 0.29.13 |
| CVE-2026-72874 | 8.7 | Aug 10 | Dokploy: Command Injection via Unescaped Git URL in Clone Commands Affected: < 0.29.13 |
| CVE-2026-72870 | 8.7 | Aug 10 | Dokploy: Command Injection via Docker Credentials in buildRemoteDocker Affected: < 0.29.13 |
| CVE-2026-72734 | 8.4 | Aug 10 | Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registration Affected: >= 0.28.7, < 0.29.13 |
| CVE-2026-45790 | 8.0 | Aug 17 | Dokploy: Invitation Role Escalation Allows Organization Takeover Affected: < 0.29.6 |
| CVE-2026-72871 | 7.5 | Aug 10 | Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback Affected: < 0.29.13 |
Showing 13