Critical vulnerabilities, curated daily for security professionals
Self-hosted deployment and container management platforms dominated Saturday's disclosures, led by a cluster of Dokploy PaaS vulnerabilities and exposed Docker management interfaces. The day brought 18 critical CVEs (CVSS 9.0+), down 5% from the prior day's 19, alongside 63 high-priority CVEs, up 9% from 58. CVE-2026-45631 (CVSS 10) and several companion flaws in Dokploy PaaS headline the critical set, joined by CVE-2026-45625 (CVSS 9.9) in the Arcane Docker container management interface and CVE-2026-10042 (CVSS 9.8) in the manga-image-translator API server. The concentration in PaaS control planes, container orchestration, and exposed management APIs points to remote code execution and authentication bypass risk on internet-facing developer and operations infrastructure. No patches were available at disclosure for the critical issues, so affected operators should prioritize access restriction and network isolation while fixes are pending.
Immediate action: Prioritize self-hosted Dokploy PaaS, Arcane Docker, and other exposed container management interfaces, restricting network access and enforcing authentication on management endpoints while vendor patches remain unavailable. Separately, expedite remediation of the actively exploited Palo Alto Networks PAN-OS and LiteSpeed cPanel plugin flaws where vendor fixes exist. With 0% patch availability for the critical set, treat isolation and monitoring as the primary near-term controls.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability - Active in CISA KEV catalog.
A supply chain compromise of DAEMON Tools Lite resulted in the distribution of trojanized binaries signed with a legitimate certificate.
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability - Active in CISA KEV catalog.
Nx Console Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
GitHub Actions OIDC was exploited to publish malicious npm packages by chaining multiple vulnerabilities, including cache poisoning and token extraction.
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user.
Arcane's REST API fails to enforce admin-level authorization on Git repository management endpoints, allowing authenticated users to exfiltrate sensitive credentials.
The manga-image-translator API server is vulnerable to remote code execution via unsafe deserialization of untrusted pickle data in the share.py module.
Dokploy contains a command injection vulnerability in its Docker file upload functionality that allows authenticated users to execute arbitrary OS commands.
Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint that allows authenticated users to execute arbitrary commands with root privileges.
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
A hardcoded authentication secret in Dokploy allows unauthenticated attackers to forge JWTs, gain administrative access, and execute commands on the host system via SSH.
A Server-Side Template Injection (SSTI) vulnerability in the Mautic theme engine allows authenticated users with theme upload permissions to execute arbitrary code on the server.
A path traversal vulnerability in Dokploy allows authenticated users to write arbitrary files to the host or remote servers during application deployment, leading to full system compromise.
An OS command injection vulnerability in the Dokploy /listen-deployment WebSocket endpoint allows authenticated users to execute arbitrary commands on remote servers.
A broken access control vulnerability in the Dokploy schedule router allows authenticated users to manage schedules belonging to other organizations, leading to RCE.
Interinfo's DreamMaker contains an arbitrary file upload vulnerability that allows unauthenticated remote attackers to execute web shells and achieve code execution.
SillyTavern versions prior to 1.18.0 have an authentication bypass vulnerability when SSO is configured, allowing unauthorized access as any user.
A Jinja2 template injection vulnerability in RAGFlow's prompt generator allows authenticated users to execute arbitrary OS commands on the server.
Shopper's admin panel contains authorization defects that allow low-privilege users to escalate their privileges to full administrator.
cpp-httplib is vulnerable to header injection because it performs validity checks before percent-decoding, allowing attackers to inject CRLF sequences into HTTP headers.
Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.
The Formie plugin for Craft CMS is vulnerable to remote code execution due to improper evaluation of user-supplied Twig templates within hidden form fields.
Use after free in Proxy in Google Chrome prior to 148
Use after free in PDFium in Google Chrome prior to 148
Use after free in SVG in Google Chrome prior to 148
Use after free in WebCodecs in Google Chrome prior to 148
Use after free in DOM in Google Chrome prior to 148
Use after free in Network in Google Chrome prior to 148
Use after free in ANGLE in Google Chrome prior to 148
Use after free in Base in Google Chrome prior to 148
Use after free in Browser in Google Chrome on Mac prior to 148
Use after free in DOM in Google Chrome prior to 148
Use after free in Skia in Google Chrome prior to 148
Use after free in ANGLE in Google Chrome prior to 148
Heap buffer overflow in WebCodecs in Google Chrome prior to 148
Heap buffer overflow in ANGLE in Google Chrome prior to 148
Use after free in ANGLE in Google Chrome prior to 148
Use after free in Media in Google Chrome on Windows prior to 148
Use after free in XML in Google Chrome prior to 148
Use after free in WebAudio in Google Chrome prior to 148
Use after free in PDF in Google Chrome prior to 148
Use after free in PDFium in Google Chrome prior to 148
Use after free in SurfaceCapture in Google Chrome prior to 148
Use after free in WebRTC in Google Chrome prior to 148
Use after free in Glic in Google Chrome prior to 148
Use after free in UI in Google Chrome on Windows prior to 148
Use after free in Network in Google Chrome prior to 148
Use after free in WebXR in Google Chrome prior to 148
Integer overflow in WTF in Google Chrome prior to 148
Integer overflow in ANGLE in Google Chrome prior to 148
Insufficient validation of untrusted input in USB in Google Chrome prior to 148
Type Confusion in V8 in Google Chrome prior to 148
Out of bounds write in ANGLE in Google Chrome prior to 148
Out of bounds write in V8 in Google Chrome prior to 148
Out of bounds memory access in ANGLE in Google Chrome prior to 148
Out of bounds read in ANGLE in Google Chrome on Windows prior to 148
Inappropriate implementation in V8 in Google Chrome prior to 148
Out of bounds write in ANGLE in Google Chrome prior to 148
Integer overflow in V8 in Google Chrome prior to 148
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148
Out of bounds write in V8 in Google Chrome prior to 148
Inappropriate implementation in USB in Google Chrome prior to 148
Type Confusion in Skia in Google Chrome prior to 148
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148
HAX CMS helps manage microsite universe with PHP or NodeJs backends
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop
WWBN AVideo is an open source video platform
HaPe PKH 1
Dokploy is a free, self-hostable Platform as a Service (PaaS)
Arcane is an interface for managing Docker containers, images, networks, and volumes
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP
Spatie Laravel Media Library before version 11
FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol
A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP
A vulnerability was determined in TRENDnet TEW-432BRP 3
A vulnerability was identified in TRENDnet TEW-432BRP 3
A weakness has been identified in Shibby Tomato 1
A security vulnerability has been detected in Shibby Tomato up to 1
A vulnerability was detected in Shibby Tomato 1
OpenClaw before 2026
The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization
NanoClaw version 1
OpenLearnX is an open-source, decentralized learning and assessment platform
In JetBrains YouTrack before 2026