Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,298All CVEsplus 19,140 rejected
- 452Last 24 hours2,722 in the last 7 days
- 16,915Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 35 | 12 | 7 | 0 | 1 | 55 | 59 |
| 2025 | 1 | 0 | 2 | 1 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-116068 | Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC RouterDokploy · dokploy | High8.7 |
| CVE-2026-111331 | Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC RouterDokploy · Dokploy | Medium5.3 |
| CVE-2026-93425 | Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as rootDokploy · dokploy | Critical9.9 |
| CVE-2026-86059 | Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.oneDokploy · dokploy | Critical9.6 |
| CVE-2026-45791 | Dokploy: Password Change Does Not Revoke Active SessionsDokploy · dokploy | Medium5.9 |
| CVE-2026-45790 | Dokploy: Invitation Role Escalation Allows Organization TakeoverDokploy · dokploy | High8.0 |
| CVE-2026-72902 | Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryByIdDokploy · dokploy | Critical9.9 |
| CVE-2026-72901 | Dokploy: Remote Code Execution via volume-backupDokploy · dokploy | Critical9.9 |
| CVE-2026-72886 | Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)Dokploy · dokploy | Critical9.9 |
| CVE-2026-72885 | Dokploy: Authenticated Command Injection in Dokploy Dockerfile BuilderDokploy · dokploy | None0.0 |
| CVE-2026-72884 | Dokploy: Command Injection via Compose Custom CommandDokploy · dokploy | High8.7 |
| CVE-2026-72883 | Dokploy: WebSocket Terminal Missing Service-Level Access ControlDokploy · dokploy | High8.8 |
| CVE-2026-72882 | Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed serversDokploy · dokploy | Critical9.9 |
| CVE-2026-72881 | Dokploy: Command Injection via database credentials in backup/restore commandsDokploy · dokploy | Medium6.4 |
| CVE-2026-72880 | Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`Dokploy · dokploy | Critical9.9 |
| CVE-2026-72879 | Dokploy: Command Injection via Registry Credentials in Swarm UploadDokploy · dokploy | Critical9.4 |
| CVE-2026-72878 | Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell argumentsDokploy · dokploy | Critical9.6 |
| CVE-2026-72877 | Dokploy: Command Injection via dockerImage in buildRemoteDockerDokploy · dokploy | Critical9.6 |
| CVE-2026-72876 | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*Dokploy · dokploy | Critical9.9 |
| CVE-2026-72875 | Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFileDokploy · dokploy | High8.8 |
| CVE-2026-72874 | Dokploy: Command Injection via Unescaped Git URL in Clone CommandsDokploy · dokploy | High8.7 |
| CVE-2026-72873 | Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`Dokploy · dokploy | Medium6.5 |
| CVE-2026-72872 | Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`Dokploy · dokploy | Critical9.9 |
| CVE-2026-72871 | Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth CallbackDokploy · dokploy | High7.5 |
| CVE-2026-72870 | Dokploy: Command Injection via Docker Credentials in buildRemoteDockerDokploy · dokploy | High8.7 |
| CVE-2026-72869 | Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCEDokploy · dokploy | Critical9.9 |
| CVE-2026-72868 | Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injectionDokploy · dokploy | Critical9.9 |
| CVE-2026-72867 | Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)Dokploy · dokploy | Critical9.9 |
| CVE-2026-72866 | WebSocket Terminal Auth BypassDokploy · dokploy | High8.8 |
| CVE-2026-72865 | Dokploy: OS Command Injection via compose `composePath`Dokploy · dokploy | Critical9.9 |
| CVE-2026-72864 | Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)Dokploy · dokploy | Critical9.9 |
| CVE-2026-72863 | Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker hostDokploy · dokploy | Critical9.9 |
| CVE-2026-72862 | Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCEDokploy · dokploy | Critical9.9 |
| CVE-2026-72740 | Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`Dokploy · dokploy | Critical9.9 |
| CVE-2026-72739 | Dokploy: Command Injection via Compose Shell ExecutionDokploy · dokploy | Medium6.5 |
| CVE-2026-72738 | Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search ParameterDokploy · dokploy | Critical9.9 |
| CVE-2026-72737 | Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backupsDokploy · dokploy | Critical9.6 |
| CVE-2026-72736 | Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCEDokploy · dokploy | Critical9.9 |
| CVE-2026-72735 | Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote executionDokploy · dokploy | Critical9.9 |
| CVE-2026-72734 | Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registrationDokploy · dokploy | High8.4 |
| CVE-2026-72733 | Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restoreDokploy · dokploy | Critical9.9 |
| CVE-2026-45629 | Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket EndpointDokploy · dokploy | Critical9.9 |
| CVE-2026-43917 | Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validationDokploy · dokploy | Medium5.3 |
| CVE-2026-45628 | Dokploy: Command Injection via Unescaped Branch Fields in Deployment PipelineDokploy · dokploy | Critical9.6 |
| CVE-2026-45630 | Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo StatementDokploy · dokploy | Critical9.0 |
| CVE-2026-45631 | Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication SecretDokploy · dokploy | Critical10.0 |
| CVE-2026-45632 | Dokploy: Schedule Authorization Bypass Enables Host/Server Command ExecutionDokploy · dokploy | Critical9.9 |
| CVE-2026-45633 | Dokploy: Command Injection in /docker-container-logs EndpointDokploy · dokploy | Critical9.9 |
| CVE-2026-45661 | Dokploy: Remote Code Execution through Path TraversalDokploy · dokploy | Critical9.9 |
| CVE-2026-45662 | Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)Dokploy · dokploy | High8.8 |