Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,674 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
39,246 results · page 51 of 785
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2025-13294 | An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. | CRITICAL 9.3EPSS 0.40% | 10 August 2026 |
| CVE-2025-13293 | A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. | CRITICAL 9.3EPSS 0.37% | 10 August 2026 |
| CVE-2026-72872 | Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands… | CRITICAL 9.9EPSS 0.46% | 10 August 2026 |
| CVE-2026-72869 | Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested… | CRITICAL 9.9EPSS 0.35% | 10 August 2026 |
| CVE-2026-72868 | Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. | CRITICAL 9.9EPSS 0.36% | 10 August 2026 |
| CVE-2026-72867 | From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch,… | CRITICAL 9.9EPSS 0.49% | 10 August 2026 |
| CVE-2026-72865 | Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell… | CRITICAL 9.9EPSS 0.35% | 10 August 2026 |
| CVE-2026-72864 | Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's role,… | CRITICAL 9.9EPSS 0.27% | 10 August 2026 |
| CVE-2026-72863 | This vulnerability is fixed in 0.29.13. | CRITICAL 9.9EPSS 0.38% | 10 August 2026 |
| CVE-2026-72899 | Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. | CRITICAL 10.0EPSS 0.56% | 10 August 2026 |
| CVE-2026-72898 | Metabase SQL Injection Vulnerability | KEVCRITICAL 10.0EPSS 94.2% | 10 August 2026 |
| CVE-2026-72862 | Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server… | CRITICAL 9.9EPSS 0.55% | 10 August 2026 |
| CVE-2026-72740 | Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an… | CRITICAL 9.9EPSS 0.66% | 10 August 2026 |
| CVE-2026-72738 | Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an… | CRITICAL 9.9EPSS 0.66% | 10 August 2026 |
| CVE-2026-72737 | An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's… | CRITICAL 9.6EPSS 0.25% | 10 August 2026 |
| CVE-2026-72736 | Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). | CRITICAL 9.9EPSS 0.43% | 10 August 2026 |
| CVE-2026-72735 | Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through… | CRITICAL 9.9EPSS 0.75% | 10 August 2026 |
| CVE-2026-72733 | An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote, even when no valid database container or backup file exists. | CRITICAL 9.9EPSS 0.61% | 10 August 2026 |
| CVE-2026-48159 | Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code on developer… | CRITICAL 9.3EPSS 0.49% | 10 August 2026 |
| CVE-2026-16626 | Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. | CRITICAL 9.3EPSS 0.33% | 10 August 2026 |
| CVE-2026-48158 | use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through… | CRITICAL 9.3EPSS 0.40% | 10 August 2026 |
| CVE-2026-47754 | Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates… | CRITICAL 9.3EPSS 0.34% | 10 August 2026 |
| CVE-2026-18412 | An attacker can craft a malicious extension containing file path traversal sequences, such as ../. | CRITICAL 9.1EPSS 0.44% | 10 August 2026 |
| CVE-2026-63106 | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in… | CRITICAL 9.3EPSS 0.29% | 10 August 2026 |
| CVE-2026-68426 | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant… | CRITICAL 9.8EPSS 0.37% | 10 August 2026 |
| CVE-2026-68388 | In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current… | CRITICAL 9.8EPSS 0.51% | 10 August 2026 |
| CVE-2026-68385 | In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csum_partial() without vector facility Currently csum_partial() calls csum_copy() with copy=false and dst=NULL. | CRITICAL 9.8EPSS 0.49% | 10 August 2026 |
| CVE-2026-68381 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on… | CRITICAL 9.8EPSS 0.46% | 10 August 2026 |
| CVE-2026-68343 | In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string… | CRITICAL 9.1EPSS 0.51% | 10 August 2026 |
| CVE-2026-68302 | In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head (ip_hdr(), ipv6_hdr(), eth_hdr() or the AMT message header)… | CRITICAL 9.8EPSS 0.48% | 10 August 2026 |
| CVE-2026-68300 | In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when auth_chunk is NULL sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. | CRITICAL 9.8EPSS 0.60% | 10 August 2026 |
| CVE-2026-68170 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb->sk reference on subflow close The backlog list is updated by mptcp_data_ready() under mptcp_data_lock(). | CRITICAL 9.8EPSS 0.52% | 10 August 2026 |
| CVE-2026-68161 | In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the… | CRITICAL 9.8EPSS 0.63% | 10 August 2026 |
| CVE-2026-68160 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to… | CRITICAL 9.8EPSS 0.75% | 10 August 2026 |
| CVE-2026-68159 | In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the… | CRITICAL 9.8EPSS 0.74% | 10 August 2026 |
| CVE-2026-68158 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may… | CRITICAL 9.8EPSS 0.70% | 10 August 2026 |
| CVE-2026-68156 | In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. | CRITICAL 9.8EPSS 0.68% | 10 August 2026 |
| CVE-2026-68154 | In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. | CRITICAL 9.8EPSS 0.70% | 10 August 2026 |
| CVE-2026-68144 | In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pep_get_sb() pep_get_sb() doesn't consider that pskb_may_pull() might have relocated the skb data, and continue to access the older pointer, causing… | CRITICAL 9.8EPSS 0.54% | 10 August 2026 |
| CVE-2026-68137 | In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25_kill_by_neigh() x25_kill_by_neigh() walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25_list_lock protects… | CRITICAL 9.8EPSS 0.54% | 10 August 2026 |
| CVE-2026-68136 | In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but… | CRITICAL 9.8EPSS 0.55% | 10 August 2026 |
| CVE-2026-68127 | In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). | CRITICAL 9.8EPSS 0.54% | 10 August 2026 |
| CVE-2026-68124 | In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctp_serial_push_header() case 2 and validates… | CRITICAL 9.6EPSS 0.34% | 10 August 2026 |
| CVE-2026-68123 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. | CRITICAL 9.8EPSS 0.56% | 10 August 2026 |
| CVE-2026-68117 | In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() When tipc_sk_create() fails to insert the new socket (tipc_sk_insert() returns non-zero), its error path frees the sk… | CRITICAL 9.8EPSS 0.53% | 10 August 2026 |
| CVE-2026-59090 | This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. | CRITICAL 9.9EPSS 0.60% | 10 August 2026 |
| CVE-2026-13206 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. | CRITICAL 9.8EPSS 1.27% | 10 August 2026 |
| CVE-2026-68083 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbd_vfs_kern_path_create The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the create/mkdir/hardlink sink is not:… | CRITICAL 9.1EPSS 0.45% | 10 August 2026 |
| CVE-2026-72593 | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem. | CRITICAL 9.8EPSS 0.53% | 10 August 2026 |
| CVE-2026-72592 | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. | CRITICAL 9.8EPSS 0.53% | 10 August 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.