Skip to contentDokploy vulnerabilities
Newest
- dokployDokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)CVE-2026-456628.8 High
- dokployDokploy: Remote Code Execution via destinationPath in Container File UploadCVE-2026-456639.9 Critical
- dokployDokploy has Command Injection in its Service OperationsCVE-2026-271309.9 Critical
- dokployDokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket EndpointCVE-2026-24841Public exploit9.9 Critical
- dokployDokploy uses hardcoded credentials in installation script, which could result in database accessCVE-2026-248408.0 High
- dokployDokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headersCVE-2026-248394.7 Medium
- dokployDokploy's Preview Deployments are vulnerable to Remote Code ExecutionCVE-2025-538259.4 Critical
- dokployDokploy allows attackers to read any file that the Traefik process user can accessCVE-2025-533754.9 Medium
- dokployDokploy allows attackers to run arbitrary OS commands on the Dokploy host.CVE-2025-533766.3 Medium
- dokployDokploy Improperly Discloses User Information via user.one EndpointCVE-2025-533741.3 Low