---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions prior to 0.29.8 are vulnerable to OS command injection via the getRegistryCommands function, allowing authenticated users to execute arbitrary commands on the host server.

Executive Summary:
An authenticated command injection vulnerability in Dokploy allows a user with project access to gain full control over the underlying host operating system.

Vulnerability Details

CVE-ID: CVE-2026-72879

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.8

Vulnerability: The application fails to properly sanitize input within the getRegistryCommands function, which interpolates registry credentials directly into a shell command. An authenticated attacker can leverage this by providing malicious credentials to trigger arbitrary command execution on the host server.

Business Impact

This vulnerability carries a CVSS score of 9.4, reflecting its critical severity. Successful exploitation allows an attacker to gain unauthorized access to the server, modify host files, and potentially compromise other containers managed by the platform. This leads to a total loss of confidentiality, integrity, and availability for the affected infrastructure.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.8 or later immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review system logs for suspicious shell activity or unexpected processes initiated by the Dokploy service user.

Compensating Controls: Restrict access to the platform to trusted users only, and employ network segmentation to limit the potential blast radius of a compromised container host.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of input sanitization in a function that interacts directly with the system shell.

Analyst Recommendation

Given the critical severity of this OS command injection vulnerability, administrators should prioritize patching their Dokploy instances. Applying version 0.29.8 or higher is essential to prevent unauthorized system access and potential full host compromise.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy prior to 0.29.13 is vulnerable to OS command injection via the backup and restore pipeline, allowing authenticated admins to execute arbitrary commands on the host machine.

Executive Summary:
This critical OS command injection vulnerability in Dokploy allows an authenticated administrator to execute arbitrary commands on the host server, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72878

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The vulnerability exists in the backup and restore pipeline, where user-controlled database fields are improperly sanitized before being passed to system shell execution functions, allowing for command injection by an authenticated user with administrative privileges.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a severe threat to infrastructure. Because the commands execute on the host machine rather than within a container, an attacker can escape the application environment to gain full control of the underlying host operating system, resulting in total loss of confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.29.13 or later to implement secure command handling and input sanitization.

Proactive Monitoring: Audit logs for suspicious shell process execution or unexpected child processes spawning from the Dokploy service.

Compensating Controls: Ensure that the Dokploy service is running with the least privilege necessary, and consider implementing host-based intrusion detection systems to alert on unauthorized command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the ability to escape container isolation makes this a high-priority risk for all users.

Analyst Recommendation

Administrators should treat this as a high-urgency update. Patching the application to version 0.29.13 is the only effective way to remediate the unsafe command interpolation within the backup and restore pipeline.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 are vulnerable to OS command injection via the dockerImage field, allowing authenticated users to execute arbitrary commands on build hosts.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy allows malicious actors to execute arbitrary code on build hosts, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72877

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability involves improper neutralization of special elements used in OS commands within the buildRemoteDocker function. An attacker with application management privileges can inject shell commands through the dockerImage parameter to achieve remote code execution.

Business Impact

Successful exploitation allows an authenticated attacker to gain control over the build host or remote SSH build targets. This compromise can lead to the theft of sensitive host secrets, unauthorized access to other projects, and a complete breach of the development environment. Given the critical CVSS score of 9.6, the potential for lateral movement and total system control represents a severe risk to organizational operations.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later immediately to resolve the injection flaw.

Proactive Monitoring: Review system and application logs for suspicious command execution patterns or unauthorized modifications to build configurations.

Compensating Controls: Implement strict access control policies to limit the number of users with application creation and update permissions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of input sanitization in critical build functions.

Analyst Recommendation

The vulnerability poses a critical threat to the security of the build infrastructure. IT administrators must prioritize updating the Dokploy installation to version 0.29.13 to prevent exploitation of this command injection vector.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 contain an authorization bypass and OS command injection flaw, allowing authenticated users to manipulate server IDs and execute commands on other tenants' servers.

Executive Summary:
A critical authorization bypass and command injection vulnerability in Dokploy versions prior to 0.29.13 enables cross-tenant command execution and total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72876

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This flaw involves an authorization bypass (CWE-639, CWE-862) combined with OS command injection (CWE-78), where the application fails to validate organization ownership before performing operations on server resources. An authenticated user with read-only permissions can trigger command execution on servers belonging to other tenants.

Business Impact

This vulnerability represents a catastrophic failure of multi-tenancy isolation. With a CVSS score of 9.9, an attacker can pivot between environments, execute arbitrary code on remote servers, and access data across the entire platform, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later to enforce proper authorization checks and sanitize command inputs.

Proactive Monitoring: Review audit logs for unauthorized access attempts to server IDs or unexpected cross-tenant activity.

Compensating Controls: Implement strict network-level isolation between different customer environments if immediate patching is delayed.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Aug 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of authorization bypass and command injection makes this a high-value target for attackers.

Analyst Recommendation

Given the availability of a proof-of-concept and the critical nature of the vulnerability, patching must be treated as an emergency task. Administrators should verify the update to version 0.29.13 is applied across all instances to prevent unauthorized cross-tenant access.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions prior to 0.29.13 are vulnerable to OS command injection, which can be exploited by an authenticated user to achieve arbitrary command execution.

Executive Summary:
An OS command injection vulnerability in Dokploy permits authenticated users to execute arbitrary commands, posing a high risk to the security and availability of the PaaS environment.

Vulnerability Details

CVE-ID: CVE-2026-72875

Affected Software: Dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability occurs due to improper neutralization of special elements within OS commands. It allows an authenticated user to inject malicious instructions that are then executed by the underlying operating system.

Business Impact

Exploitation of this flaw allows an attacker to bypass security boundaries, potentially leading to unauthorized access to the underlying infrastructure hosting the Platform as a Service. With a CVSS score of 8.8, this represents an extreme risk to the integrity of all applications managed by the affected Dokploy instance.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.29.13 or later to apply the necessary security fixes.

Proactive Monitoring: Monitor server logs for unexpected command execution and analyze application performance for signs of unauthorized resource consumption or anomalous activity.

Compensating Controls: Implement network-level segmentation to isolate the Dokploy management plane and utilize a Web Application Firewall to sanitize incoming requests for command injection characters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. OS command injection is a critical class of vulnerability that requires immediate attention regardless of current exploit availability.

Analyst Recommendation

The ability for an authenticated user to perform command injection is a significant security failure that must be addressed immediately. All administrators should verify their current deployment version and perform the update to 0.29.13 as soon as possible to mitigate the risk of unauthorized system control.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy is affected by an OS command injection vulnerability, enabling authenticated users to execute arbitrary commands via improper input neutralization.

Executive Summary:
An OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands, posing a critical risk to host integrity.

Vulnerability Details

CVE-ID: CVE-2026-72874

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to properly neutralize special elements in OS commands (CWE-78). This allows an authenticated user to bypass security controls and execute arbitrary commands on the underlying server.

Business Impact

This vulnerability provides a pathway for an authenticated attacker to gain full control over the host server. Given the CVSS score of 8.7, it is critical to address this to prevent unauthorized access, data theft, and potential ransomware deployment.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13, which contains the upstream fix for this command injection vulnerability.

Proactive Monitoring: Monitor server logs for unauthorized command execution patterns or anomalous outbound network connections from the Dokploy host.

Compensating Controls: Implement strict ingress filtering and monitor for unusual input strings in application fields that interact with system-level commands.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if the attacker has authenticated access to the platform.

Analyst Recommendation

Administrators must update to version 0.29.13 immediately to resolve this vulnerability. Continued operation of older versions exposes the host environment to significant risk of unauthorized command execution and system takeover.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy improperly validates Bitbucket repository fields, allowing authenticated users to inject arbitrary OS commands into git clone operations.

Executive Summary:
A critical command injection flaw in Dokploy enables authenticated users to execute arbitrary commands on the host or target server.

Vulnerability Details

CVE-ID: CVE-2026-72872

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to sanitize Bitbucket owner and repository inputs before passing them to system commands. Authenticated users with service deployment permissions can inject malicious command arguments, leading to remote code execution on the host or target server.

Business Impact

This vulnerability is rated at 9.9 on the CVSS scale, indicating a critical risk of complete system compromise. Successful exploitation allows an attacker to execute arbitrary OS commands, leading to data exfiltration, service disruption, or lateral movement within the network.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later to implement the required input validation and secure command execution.

Proactive Monitoring: Monitor server logs for unexpected git commands or shell execution patterns. Audit the activities of users with service deployment permissions for anomalous behavior.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect and block suspicious input strings in API requests. Ensure that the application runs with strictly limited operating system privileges.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its potential for direct command execution.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update to version 0.29.13. Security teams should prioritize patching this instance to prevent potential unauthorized code execution by malicious or compromised internal accounts.

---METADATA---
VENDOR: Dokploy
PRODUCT: Dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy contains a critical missing authentication vulnerability in its platform management functions, allowing unauthorized actors to perform administrative actions.

Executive Summary:
A critical authentication bypass vulnerability in Dokploy allows unauthenticated remote attackers to perform unauthorized actions on the platform, presenting a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-72871

Affected Software: Dokploy Dokploy

Affected Versions: < 0.29.13

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). An unauthenticated remote attacker can interact with critical platform features without providing valid credentials.

Business Impact

This vulnerability allows an attacker to gain unauthorized control over platform management, potentially leading to unauthorized deployment, configuration changes, or complete system compromise. With a CVSS score of 7.5, the impact on integrity is high, as the attacker can manipulate the platform state.

Remediation Plan

Immediate Action: Upgrade all Dokploy instances to version 0.29.13 or later to enforce proper authentication checks for all critical functions.

Proactive Monitoring: Audit logs for unauthorized management actions or unexpected configuration changes that occurred prior to applying the patch.

Compensating Controls: Restrict access to the Dokploy management dashboard using VPNs or IP whitelisting to prevent exposure to the public internet until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication for administrative functions.

Analyst Recommendation

This vulnerability is highly critical due to the presence of a proof-of-concept and the nature of the flaw. Immediate patching to version 0.29.13 is required to secure the platform against unauthorized administrative access.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy is susceptible to OS command injection, allowing an authenticated attacker to execute arbitrary system commands on the host.

Executive Summary:
A critical OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72870

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to properly neutralize special elements used in OS commands, resulting in a command injection flaw. This vulnerability requires the attacker to have low privileges (authenticated) to trigger the malicious payload.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the application process. Given the CVSS score of 8.7, this represents a significant risk of unauthorized access, potential data exfiltration, and complete loss of control over the PaaS environment.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later to resolve the underlying command injection flaw.

Proactive Monitoring: Monitor server access logs for unusual command patterns or unexpected process execution requests originating from the Dokploy service account.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the potential impact if the application is compromised.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection flaws are inherently dangerous as they grant attackers direct interaction with the underlying operating system.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Administrators should verify their current deployment version and apply the patch to 0.29.13 or higher immediately to mitigate the risk of command injection.

---METADATA---
VENDOR: Zyxel
PRODUCT: NWA1100-N
AFFECTED_VERSIONS: 1.00(AACE.1)C0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Multiple functions in the Zyxel NWA1100-N firmware contain a buffer overflow vulnerability, potentially allowing remote attackers to trigger a denial-of-service.

Executive Summary:
A buffer overflow vulnerability in the Zyxel NWA1100-N firmware poses a risk of remote denial-of-service, though the product is currently end-of-life.

Vulnerability Details

CVE-ID: CVE-2026-7287

Affected Software: Zyxel NWA1100-N

Affected Versions: 1.00(AACE.1)C0

Vulnerability: This is a classic buffer overflow (CWE-120) located in the "webs" binary, specifically within the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions. The vulnerability is remotely exploitable by an unauthenticated attacker.

Business Impact

The CVSS score of 7.5 highlights a high risk to availability. Because the device is an infrastructure component, a successful crash or service interruption could disrupt network connectivity for all users reliant on the NWA1100-N access point.

Remediation Plan

Immediate Action: Since this device is end-of-life, the only effective remediation is to replace the affected hardware with a currently supported model.

Proactive Monitoring: Monitor for unusual traffic patterns or unexpected device reboots that may indicate exploitation attempts.

Compensating Controls: Place the device behind a robust firewall and restrict management interface access to a dedicated, isolated management VLAN.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit in available data)

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given that the vendor has declared the product end-of-life, no further security updates are expected.

Analyst Recommendation

Because Zyxel NWA1100-N is no longer receiving security support, remediation cannot rely on patching. Organizations still utilizing this hardware should plan for immediate decommissioning and replacement with supported equipment to eliminate this persistent security risk.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Dokploy prior to 0.29.13 allows authenticated users with backup permissions to execute arbitrary commands in the host context via crafted database names.

Executive Summary:
Dokploy versions prior to 0.29.13 contain a critical OS command injection vulnerability that allows authenticated users to achieve arbitrary command execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72869

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The vulnerability resides in the backup.restoreBackupWithLogs tRPC subscription, where the databaseName parameter is insufficiently sanitized before being passed to shell commands. This allows an authenticated attacker with specific permissions to escape the intended context and execute commands with the privileges of the host Docker container.

Business Impact

This vulnerability allows for privilege escalation and full system compromise, as an authenticated attacker can execute arbitrary commands in the host environment. With a CVSS score of 9.9, this represents a severe threat to the security of the entire PaaS infrastructure managed by Dokploy, potentially enabling lateral movement across the network.

Remediation Plan

Immediate Action: Update the Dokploy installation to version 0.29.13 or later immediately.

Proactive Monitoring: Audit logs for the backup and restore processes to identify any unusual input strings or unexpected shell command execution patterns.

Compensating Controls: Enforce strict access control policies to limit the number of users with the backup:restore permission until the patch can be successfully deployed.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it allows for container breakout and host system compromise.

Analyst Recommendation

The severity of this command injection flaw mandates an immediate update to version 0.29.13. Security teams should verify that all instances of Dokploy are updated and review the permissions of all users within the platform to minimize the attack surface until the remediation is confirmed.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy allows a low-privileged member to execute arbitrary OS commands as root by injecting malicious input into the rclone configuration fields during test connection operations.

Executive Summary:
A critical command injection vulnerability in Dokploy allows low-privileged users to achieve full administrative control over the host system.

Vulnerability Details

CVE-ID: CVE-2026-72868

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application incorrectly handles user-supplied input when performing test connections for cloud storage destinations. A low-privileged member can bypass authorization checks to execute arbitrary commands on the host container, which holds dangerous access to the host Docker socket.

Business Impact

With a CVSS score of 9.9, this vulnerability poses an extreme risk to the entire infrastructure. Because the Dokploy container has access to the host Docker socket, an attacker can escape the container, compromise the host operating system, and potentially gain access to all other containers managed by the host.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.29.13 or later immediately to patch the command injection vector.

Proactive Monitoring: Review audit logs for unusual command executions or unexpected processes spawning from the Dokploy service. Monitor for unauthorized creation of new containers or modification of existing ones.

Compensating Controls: Run the Dokploy container with the least privilege necessary and avoid mounting the Docker socket unless absolutely required. Implement network segmentation to isolate the PaaS environment from sensitive internal systems.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe due to the combination of command injection and container escape potential.

Analyst Recommendation

This vulnerability represents a critical security failure. Administrators must update to 0.29.13 immediately to neutralize the risk of full infrastructure compromise.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: >= 0.29.3, < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions 0.29.3 through 0.29.12 are susceptible to OS command injection due to insufficient server-side validation of git branch fields during deployment operations.

Executive Summary:
Insufficient input validation in Dokploy allows authenticated users to trigger OS command injection by supplying malicious input to Git branch configuration fields.

Vulnerability Details

CVE-ID: CVE-2026-72867

Affected Software: Dokploy dokploy

Affected Versions: >= 0.29.3, < 0.29.13

Vulnerability: This issue stems from an incomplete fix for a previous vulnerability, where server-side validation is missing for various Git branch parameters. An authenticated user can inject malicious characters into these fields, which are subsequently passed to shell-based Git commands, leading to arbitrary OS command execution on the host.

Business Impact

The vulnerability carries a CVSS score of 9.9, indicating critical severity. Successful exploitation permits an attacker to execute commands with the privileges of the Dokploy service, potentially leading to full server compromise, data theft, and the destruction of deployment environments.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13, which includes the necessary server-side validation to prevent command injection.

Proactive Monitoring: Audit configuration changes related to Git branches and monitor for unusual Git-related process execution on the host system.

Compensating Controls: Use Web Application Firewalls (WAF) to inspect and block requests containing meta-characters or shell command syntax in branch name fields if patching is delayed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw highlights the necessity of comprehensive server-side input validation for all user-supplied data, especially when that data interacts with system shells.

Analyst Recommendation

This vulnerability is a significant risk that could lead to total system compromise. Administrators must apply the version 0.29.13 update immediately to ensure robust input validation is enforced across all Git-related deployment functions.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in Dokploy allows authenticated users to perform unauthorized actions due to improper capability checks.

Executive Summary:
A missing authorization flaw in Dokploy allows authenticated attackers to bypass security controls, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-72866

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The software suffers from a missing authorization vulnerability (CWE-862) which allows an attacker with low privileges to perform unauthorized actions. The attack requires the user to be authenticated to the platform.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to perform actions beyond their intended permission level, potentially leading to unauthorized data access, modification of system configurations, or service disruption. With a CVSS score of 8.8, this flaw represents a significant risk to the security posture of the affected PaaS environment.

Remediation Plan

Immediate Action: Update the Dokploy installation to version 0.29.13 or later as specified in the official vendor release.

Proactive Monitoring: Review administrative access logs for suspicious account activity or requests originating from low-privileged user accounts that deviate from expected behavioral patterns.

Compensating Controls: Implement strict network access controls to limit the exposure of the management interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from a failure to validate user capabilities during sensitive operations.

Analyst Recommendation

The vulnerability presents a high risk due to the potential for unauthorized administrative actions. Administrators should prioritize patching to version 0.29.13 immediately to eliminate the authorization bypass vector and secure the platform.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions prior to 0.29.13 contain an OS command injection vulnerability in the compose update process, allowing authenticated users to execute arbitrary commands on the host system.

Executive Summary:
A critical OS command injection vulnerability in Dokploy allows authenticated users to execute arbitrary commands on the host operating system with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-72865

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to properly sanitize the composePath variable before passing it to system shell commands. An authenticated user with sufficient permissions can inject malicious payloads into this path, resulting in arbitrary OS command execution within the context of the Dokploy host.

Business Impact

With a CVSS score of 9.9, this vulnerability allows for full system compromise. An attacker who successfully exploits this flaw can gain persistent access to the host server, modify system configurations, and pivot into other parts of the internal network, posing a catastrophic risk to organizational security.

Remediation Plan

Immediate Action: Update the Dokploy installation to version 0.29.13 to implement input validation and secure command execution practices.

Proactive Monitoring: Monitor server logs for suspicious command-line activity or child processes spawned by the Dokploy service that deviate from normal operational baselines.

Compensating Controls: Implement strict file system permissions for the user account running the Dokploy service to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on shell-based execution without sufficient sanitization makes this a high-value target for attackers.

Analyst Recommendation

This is a critical security flaw that enables complete host takeover. Given the ease of triggering this via the compose update functionality, all instances should be patched to version 0.29.13 without delay.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 are vulnerable to a missing authorization flaw in the docker-container-terminal component, allowing authenticated users to gain a root shell in arbitrary containers.

Executive Summary:
A critical authorization bypass in Dokploy allows authenticated members to achieve root-level command execution within arbitrary containers on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72864

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability occurs due to missing authorization checks in the docker-container-terminal component. While the request is authenticated, the system fails to validate if the user has permission to access the specified container, allowing any authenticated user to execute arbitrary commands as root via the docker exec function.

Business Impact

Successful exploitation grants an attacker full control over any container running on the self-hosted Dokploy instance. Given the CVSS score of 9.9, this represents a near-total compromise of the application environment, potentially leading to data exfiltration, service disruption, and lateral movement within the underlying infrastructure.

Remediation Plan

Immediate Action: Upgrade the Dokploy instance to version 0.29.13 or later immediately to incorporate the necessary authorization validation logic.

Proactive Monitoring: Review audit logs for unusual container access patterns or unexpected execution of shell commands within high-value containers.

Compensating Controls: Restrict access to the Dokploy dashboard to trusted users via network-level controls, such as VPNs or IP whitelisting, until the update is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of container escape potential and lack of access control.

Analyst Recommendation

This vulnerability presents a severe risk to the integrity and confidentiality of containerized workloads. Administrators should prioritize updating to version 0.29.13 immediately to eliminate the possibility of unauthorized root access.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions prior to 0.29.13 fail to enforce authorization checks on WebSocket handlers, allowing authenticated users to access interactive shells and escalate privileges to root.

Executive Summary:
A critical authorization bypass in Dokploy allows authenticated users to obtain root-level access and escape tenant boundaries via insecure WebSocket handlers.

Vulnerability Details

CVE-ID: CVE-2026-72863

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to perform role-based access control checks within WebSocket handlers for terminal and log streaming. An authenticated user can bypass authorization to gain access to containers, including those mounting the Docker socket, facilitating host-level root escalation.

Business Impact

This vulnerability enables total tenant isolation breakdown, meaning an attacker can move laterally across the entire platform. With a CVSS score of 9.9, the impact includes full system compromise, data exfiltration, and the ability to manipulate all hosted services. This represents an existential risk to the integrity and confidentiality of all hosted applications within the Dokploy environment.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later to enforce correct authorization logic on all WebSocket sessions.

Proactive Monitoring: Monitor WebSocket traffic and shell session creation for anomalous activity originating from standard user accounts.

Compensating Controls: Restrict network access to the management interface and enforce strict session management to reduce the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the bypass of critical authorization controls.

Analyst Recommendation

Given the extreme severity and the availability of proof-of-concept information, immediate patching is required. Organizations must treat this as a high-priority remediation to prevent unauthorized host access.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy contains an OS command injection vulnerability in its database service deployment functions, allowing authenticated users to execute arbitrary commands on the remote server.

Executive Summary:
An OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands during database service deployment, risking full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-72862

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability involves improper neutralization of special elements used in an OS command (CWE-78). The software fails to properly quote user-controlled input for the dockerImage field before passing it to shell commands, allowing an authenticated attacker to inject arbitrary system commands.

Business Impact

Successful exploitation allows an authenticated user to gain code execution on the underlying host server. Because the affected functions are used for infrastructure deployment, an attacker could escalate privileges or gain persistent access to the server environment. This vulnerability is highly dangerous, as evidenced by its 9.9 CVSS score, which reflects the potential for complete system compromise.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later, which includes the necessary fixes to properly quote and sanitize input for container deployment commands.

Proactive Monitoring: Monitor server logs for unexpected shell activity or unauthorized container deployment attempts originating from the Dokploy administrative interface.

Compensating Controls: Implement network segmentation to isolate the Dokploy management interface and restrict access to only trusted administrative users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, which serves as a primary, though insufficient, layer of defense.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators should treat this as a high-priority update. Ensure that all Dokploy instances are updated to version 0.29.13 and audit user access logs to ensure no unauthorized activity occurred prior to the patch.

---METADATA---
VENDOR: Budibase
PRODUCT: server
AFFECTED_VERSIONS: 3.39.4 up to (excluding) 3.40.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Budibase server is affected by an authorization regression related to S3 presigned URLs, allowing unauthorized access.

Executive Summary:
An authorization regression in Budibase server versions 3.39.4 to 3.40.0 allows authenticated users to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-72859

Affected Software: Budibase server

Affected Versions: 3.39.4 up to (excluding) 3.40.0

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) where the application fails to properly validate permissions before granting access to resources via S3 presigned URLs.

Business Impact

The vulnerability allows an authenticated attacker to perform unauthorized actions, potentially compromising the integrity of data stored in S3 buckets. With a CVSS score of 7.7, the risk of unauthorized data modification or access is significant for business operations relying on Budibase.

Remediation Plan

Immediate Action: Upgrade to Budibase server version 3.40.0 or later to resolve the authorization regression.

Proactive Monitoring: Review access logs for unusual patterns of S3 resource access that deviate from normal user workflow behavior.

Compensating Controls: Temporarily restrict access to S3-related features if upgrading is not immediately possible, or implement strict IAM policies on the S3 buckets to limit accessible scope.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or public PoC identified).

Analyst Notes: As of August 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is an authorization regression introduced in recent versions.

Analyst Recommendation

Administrators should treat this as a high-priority update. Upgrading to version 3.40.0 is the definitive fix to restore proper authorization checks and prevent potential unauthorized data manipulation.

---METADATA---
VENDOR: Budibase
PRODUCT: Server
AFFECTED_VERSIONS: 0 up to (excluding) 3.40.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Budibase server versions before 3.40.0 contain an unauthenticated SQL injection vulnerability in webhook-triggered automations, allowing remote attackers to exfiltrate or modify database data.

Executive Summary:
A critical SQL injection vulnerability in Budibase server allows unauthenticated attackers to execute arbitrary database commands, posing a severe risk of data compromise and system persistence.

Vulnerability Details

CVE-ID: CVE-2026-72851

Affected Software: Budibase Server

Affected Versions: 0 up to (excluding) 3.40.0

Vulnerability: The vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89) within webhook-triggered automations. Although the CVSS vector indicates low privileges are required, the description confirms the attack vector is unauthenticated, allowing remote actors to inject malicious payloads into database queries.

Business Impact

Successful exploitation grants an attacker the ability to interact directly with the underlying database using the application's configured credentials. This can lead to total data exfiltration, unauthorized modification of sensitive information, or the establishment of long-term persistence within the database environment. With a CVSS score of 10.0, this flaw represents the highest level of risk to business operations and data confidentiality.

Remediation Plan

Immediate Action: Update Budibase server to version 3.40.0 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review application logs for anomalous POST requests sent to webhook endpoints and monitor database query logs for unusual or unexpected execution patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict input validation rules to block malformed JSON payloads targeting webhook endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the potential for unauthenticated remote code and query execution.

Analyst Recommendation

The severity of this vulnerability cannot be overstated given the potential for full database compromise. Administrators must prioritize the application of the 3.40.0 update across all production environments to eliminate the injection vector.

---METADATA---
VENDOR: langchain-ai
PRODUCT: langchain-community
AFFECTED_VERSIONS: 0 through 0.4.2
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
The SitemapLoader component in langchain-community versions up to 0.4.2 is vulnerable to Server-Side Request Forgery (SSRF) due to missing domain restrictions on nested sitemap entries.

Executive Summary:
The SitemapLoader in langchain-community is susceptible to Server-Side Request Forgery, allowing unauthenticated attackers to probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-72848

Affected Software: langchain-ai langchain-community

Affected Versions: 0 through 0.4.2

Vulnerability: The SitemapLoader fails to enforce domain restrictions on nested sitemap index entries, which allows for Server-Side Request Forgery (CWE-918) that can be triggered by an unauthenticated attacker.

Business Impact

An attacker can use this vulnerability to perform requests against internal services or cloud metadata endpoints that are otherwise inaccessible from the public internet. This exposure can lead to the discovery of internal network topology and potential unauthorized access to sensitive internal data, justifying the high CVSS score of 8.6.

Remediation Plan

Immediate Action: Review the official LangChain security advisories and update to the latest version of langchain-community where the SitemapLoader domain validation logic has been hardened.

Proactive Monitoring: Monitor outbound network traffic from the application host for requests directed toward internal IP addresses or sensitive infrastructure endpoints.

Compensating Controls: Use network-level egress filtering to restrict the application from reaching internal network segments or unauthorized external domains.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable in environments where the application is deployed with network access to internal resources.

Analyst Recommendation

Due to the risk of internal network reconnaissance and potential data leakage, organizations using the SitemapLoader component should prioritize updating their libraries. Implementing egress filtering is a highly recommended secondary measure to minimize the blast radius of potential SSRF vulnerabilities.

---METADATA---
VENDOR: openwrt
PRODUCT: luci
AFFECTED_VERSIONS: openwrt luci
CONFIDENCE: medium
MISSING: versions
---END_METADATA---

Description Summary:
An ACL inconsistency in the OpenWrt LuCI LXC application allows authenticated users with low privileges to bypass authorization and execute arbitrary code as root on the host.

Executive Summary:
A critical authorization bypass and path traversal vulnerability in the OpenWrt LuCI LXC application allows low-privileged users to achieve root code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72842

Affected Software: openwrt luci

Affected Versions: openwrt luci

Vulnerability: This vulnerability, classified as CWE-73, involves an ACL inconsistency that permits path traversal via the lxc_name parameter. By escaping container directories, an authenticated user with low privileges can trigger host-side scripts, resulting in root-level code execution on the OpenWrt host.

Business Impact

The CVSS score of 9.9 highlights the extreme danger of this flaw. By allowing a low-privileged user to escalate to root-level host control, the vulnerability enables complete compromise of the network device, which can be used to intercept traffic, modify configurations, or pivot into internal network segments.

Remediation Plan

Immediate Action: Update the OpenWrt LuCI installation to the latest version as specified in the official vendor security advisory.

Proactive Monitoring: Review LuCI access logs for suspicious input sequences, specifically searching for path traversal patterns like /.%2E.

Compensating Controls: Limit administrative access to the LuCI interface to trusted management networks and strictly enforce the principle of least privilege for all user accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity requires authenticated access, but the impact of full host compromise makes it a high-priority concern for network administrators.

Analyst Recommendation

Given the potential for root-level host execution, this vulnerability poses a severe threat to network integrity. Administrators should consult the OpenWrt security advisory immediately to identify the correct patched version and apply the update to all affected devices.

---METADATA---
VENDOR: openwrt
PRODUCT: luci
AFFECTED_VERSIONS: openwrt luci
CONFIDENCE: medium
MISSING: versions
---END_METADATA---

Description Summary:
The luci-app-openvpn package for OpenWrt is vulnerable to path traversal during file uploads, enabling authenticated users to write arbitrary files and achieve root code execution.

Executive Summary:
An authenticated path traversal vulnerability in OpenWrt luci-app-openvpn allows attackers to achieve persistent root code execution on the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-72841

Affected Software: openwrt luci

Affected Versions: openwrt luci

Vulnerability: The luci-app-openvpn package fails to validate the instance_name2 parameter during file upload operations. This allows an authenticated user to perform path traversal, facilitating the placement of malicious files such as SSH keys in sensitive system directories.

Business Impact

Successful exploitation permits an authenticated attacker to gain persistent root access to the device. With a CVSS score of 9.9, the impact is catastrophic, potentially leading to full system takeover, network interception, and the compromise of all traffic passing through the affected router or gateway.

Remediation Plan

Immediate Action: Update the luci-app-openvpn package to the latest version provided by the OpenWrt project.

Proactive Monitoring: Monitor system logs for unauthorized file writes or unexpected modifications to sensitive configuration directories like /etc/ or /root/.

Compensating Controls: Restrict access to the LuCI web interface to trusted management networks only, and ensure that only highly privileged, audited users have access to the administrative dashboard.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication limits the initial attack surface, but the resulting impact is total system compromise.

Analyst Recommendation

Administrators must prioritize updating the luci-app-openvpn package to the version that includes the necessary path validation fixes. Because this vulnerability allows for persistent root access, immediate remediation is essential to maintain the integrity of the network infrastructure.

---METADATA---
VENDOR: OpenWrt
PRODUCT: LuCI
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: high
MISSING: versions
---END_METADATA---

Description Summary:
OpenWrt LuCI contains an overly permissive ACL in the system-mounts module, allowing low-privileged users to modify root crontabs for remote code execution.

Executive Summary:
A critical vulnerability in OpenWrt LuCI allows authenticated attackers with mount-configuration privileges to achieve root-level remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-72840

Affected Software: OpenWrt LuCI

Affected Versions: See vendor advisory

Vulnerability: The flaw resides in the luci-mod-system-mounts module, which incorrectly grants write access to /etc/crontabs/root. An authenticated attacker can leverage this misconfiguration to inject arbitrary cron entries via the ubus file.write function, resulting in full system compromise.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise. By gaining root access, an attacker could exfiltrate sensitive configuration data, deploy persistence mechanisms, or pivot into the internal network, leading to significant operational disruption and loss of confidentiality.

Remediation Plan

Immediate Action: Apply the vendor security updates provided in the linked advisory immediately.

Proactive Monitoring: Review system logs for unauthorized ubus calls or suspicious changes to the /etc/crontabs/root file.

Compensating Controls: Restrict access to the LuCI web interface and audit user permissions to ensure that only trusted accounts possess mount-configuration ACL capabilities.

Exploitation Status

Public Exploit Available: Yes (per CISA's SSVC assessment, a proof-of-concept exists).

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct path from a low-privilege ACL to root command execution.

Analyst Recommendation

Given the severity of this privilege escalation flaw, administrators must prioritize patching the LuCI interface. The ability for a low-privileged user to gain root execution represents an unacceptable risk to the integrity of the network infrastructure, necessitating immediate remediation.

---METADATA---
VENDOR: Easy Elements
PRODUCT: Easy Elements for Elementor
AFFECTED_VERSIONS: Up to and including 1.4.4
---END_METADATA---

Description Summary:
The Easy Elements for Elementor plugin is vulnerable to privilege escalation, allowing unauthenticated users to register as administrators.

Executive Summary:
A critical privilege escalation vulnerability in the Easy Elements for Elementor WordPress plugin allows unauthenticated attackers to gain administrative access to the site.

Vulnerability Details

CVE-ID: CVE-2026-7284

Affected Software: Easy Elements for Elementor

Affected Versions: Up to and including 1.4.4

Vulnerability: The easyel_handle_register function fails to restrict user roles during registration. An unauthenticated attacker can supply the 'administrator' role during the registration process to gain full control.

Business Impact

A CVSS score of 9.8 highlights the severity of this access control flaw. An attacker can register an administrative account, effectively taking over the entire WordPress site, which can lead to total data loss, site defacement, or the installation of backdoors.

Remediation Plan

Immediate Action: Update the Easy Elements for Elementor plugin to the latest version. Check the vendor advisory for specific patch details.

Proactive Monitoring: Review the user list for any unauthorized administrator accounts created recently and check registration logs.

Compensating Controls: Disable site registration if not strictly required, or implement an approval process for new user accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrative privilege escalation is one of the most critical vulnerabilities an application can face. Administrators must act immediately to update the plugin and perform a thorough audit of all existing user accounts to ensure no unauthorized administrators have been created.

---METADATA---
VENDOR: filebrowser
PRODUCT: filebrowser
AFFECTED_VERSIONS: 0 through 2.63.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Filebrowser through 2.63.16 contains an incorrect privilege assignment vulnerability that allows unauthenticated attackers to register accounts with full administrative access to the server root.

Executive Summary:
A critical vulnerability in filebrowser allows unauthenticated attackers to gain full administrative control over the file system by exploiting improper privilege assignment during account registration.

Vulnerability Details

CVE-ID: CVE-2026-72839

Affected Software: filebrowser filebrowser

Affected Versions: 0 through 2.63.16

Vulnerability: This is an incorrect privilege assignment vulnerability (CWE-266) occurring when self-signup is enabled with default settings. The flaw permits unauthenticated attackers to create accounts that inherit the server root scope, granting them full read, write, and delete permissions across the entire file system.

Business Impact

The potential for total system compromise is severe, as an attacker can exfiltrate sensitive data, modify core configurations, or delete critical files. Given the CVSS score of 9.8, this vulnerability represents an immediate threat to data integrity, confidentiality, and availability. Organizations relying on filebrowser for file management are at significant risk of total unauthorized access if this service is exposed to the internet.

Remediation Plan

Immediate Action: Update filebrowser to the latest version immediately to ensure privilege restrictions are correctly enforced.

Proactive Monitoring: Review user registration logs for suspicious activity or unauthorized account creations that occurred recently.

Compensating Controls: Disable the self-signup feature and restrict network access to the filebrowser interface until the software has been successfully updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of required authentication.

Analyst Recommendation

This vulnerability presents a catastrophic risk to any environment running an exposed instance of filebrowser. Administrators must prioritize updating the software to a patched version as the primary defense. Given the ease of exploitation, verify that all instances are secured and that unnecessary self-signup features are disabled immediately.

---METADATA---
VENDOR: filebrowser
PRODUCT: filebrowser
AFFECTED_VERSIONS: 0 up to 2.63.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
File Browser contains an improper access control vulnerability that enables authenticated users to escalate privileges via proxy authentication.

Executive Summary:
An improper access control vulnerability in File Browser allows authenticated attackers to escalate their privileges, posing a critical risk to file system security.

Vulnerability Details

CVE-ID: CVE-2026-72837

Affected Software: filebrowser File Browser

Affected Versions: 0 up to 2.63.20

Vulnerability: The application fails to properly enforce access controls (CWE-284) during proxy authentication processes. This allows an authenticated user to perform actions outside their assigned permission scope.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting the high potential for total system impact. Unauthorized privilege escalation could result in full access to the underlying file system, leading to data exfiltration, modification, or destruction of sensitive information.

Remediation Plan

Immediate Action: Update the File Browser installation to version 2.63.20 or later immediately to resolve the access control flaw.

Proactive Monitoring: Monitor system logs for unexpected privilege escalation events or access requests to directories outside of the expected user scope.

Compensating Controls: Restrict network access to the File Browser interface to trusted internal segments only, and ensure that authentication providers are configured with the principle of least privilege.

Exploitation Status

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly sensitive due to the potential for total technical impact.

Analyst Recommendation

Due to the availability of a proof-of-concept and the high severity of potential privilege escalation, organizations must treat this update with high urgency. Patching to the current version is the only effective way to neutralize the risk of unauthorized file system access.

---METADATA---
VENDOR: FileBrowser
PRODUCT: filebrowser
AFFECTED_VERSIONS: 0 up to (excluding) 2.63.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FileBrowser is affected by an authentication bypass vulnerability due to improper handling of case sensitivity, potentially allowing unauthorized access.

Executive Summary:
FileBrowser versions before 2.63.19 are vulnerable to an authentication bypass that could allow unauthenticated attackers to gain unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2026-72836

Affected Software: FileBrowser filebrowser

Affected Versions: 0 up to (excluding) 2.63.19

Vulnerability: The vulnerability stems from the improper handling of case sensitivity (CWE-178), which allows an attacker to bypass authentication mechanisms. This flaw can be triggered by an unauthenticated remote attacker to gain access to the application.

Business Impact

Authentication bypass vulnerabilities are critical because they grant unauthorized access to system resources without requiring valid credentials. An attacker could exploit this to view, modify, or delete sensitive files managed by the application. The CVSS 4.0 score of 8.1 indicates a high risk to the overall security posture of the affected infrastructure.

Remediation Plan

Immediate Action: Update to FileBrowser version 2.63.19 or later.

Proactive Monitoring: Review access logs for unusual login patterns or attempts to access files using varying character casing.

Compensating Controls: Restrict network access to the FileBrowser instance using IP allowlisting or VPNs until the application can be updated.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically significant because it fundamentally undermines the authentication layer of the software.

Analyst Recommendation

Authentication bypass is a severe security failure that warrants immediate attention. All users of FileBrowser must upgrade to version 2.63.19 to remediate this vulnerability and ensure that access controls are correctly enforced.

---METADATA---
VENDOR: getgrav
PRODUCT: Grav
AFFECTED_VERSIONS: Versions prior to 1.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav API plugin is vulnerable to improper privilege management, allowing authenticated users to escalate privileges via scoped API keys.

Executive Summary:
A privilege escalation vulnerability in the Grav API plugin permits authenticated attackers to gain elevated system access, posing a high security risk.

Vulnerability Details

CVE-ID: CVE-2026-72833

Affected Software: getgrav Grav

Affected Versions: Versions prior to 1.0.6

Vulnerability: This vulnerability involves improper privilege management (CWE-269) within the Grav API plugin. An attacker with low-level authenticated access can manipulate scoped API keys to perform actions beyond their authorized permission set.

Business Impact

Successful exploitation of this flaw allows a malicious actor to compromise the integrity and availability of the Grav CMS environment. Given the high CVSS score of 8.8, this vulnerability represents a significant risk to organizational data, as it grants unauthorized administrative-level capabilities to standard users.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.6 or later to resolve the privilege management flaw.

Proactive Monitoring: Review access logs for unusual API activity or unexpected administrative actions performed by low-privileged user accounts.

Compensating Controls: Implement strict access control lists for API key generation and restrict usage to necessary network segments until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for complete control over the CMS application once privileges are escalated.

Analyst Recommendation

Administrators should prioritize patching the Grav API plugin immediately to prevent potential unauthorized escalation. Ensure all API keys are audited and revoked if suspicious activity is detected during the update process.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to 1.4.7, 2.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Flex Objects plugin in Grav is vulnerable to an authorization bypass, allowing authenticated low privilege users to perform unauthorized actions.

Executive Summary:
A high severity authorization bypass vulnerability in the Grav Flex Objects plugin allows authenticated attackers to perform unauthorized operations, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72831

Affected Software: getgrav Grav

Affected Versions: 0 up to 1.4.7, 2.0.11

Vulnerability: This vulnerability is caused by an incorrect authorization check (CWE-863) within the Flex Objects plugin. An authenticated user with low privileges can bypass intended access controls to interact with restricted functions.

Business Impact

Successful exploitation of this flaw could allow an attacker to gain unauthorized access to data or administrative functions within the Grav environment. Given the high CVSS score of 8.8, this poses a significant risk to the integrity and confidentiality of the content management system, potentially resulting in unauthorized administrative control.

Remediation Plan

Immediate Action: Update the Grav installation and the Flex Objects plugin to version 1.4.7 or later to address the authorization flaw.

Proactive Monitoring: Review application access logs for unusual patterns of interaction with the Flex Objects plugin or unauthorized attempts to access administrative endpoints.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter requests targeting the Flex Objects plugin functionality until updates are applied.

Exploitation Status

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an access control failure that requires an existing authenticated session to trigger.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Administrators must prioritize updating the Grav core and associated plugins to the specified fixed versions to prevent potential unauthorized administrative access.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav API plugin fails to enforce API key scopes in the ConfigController, allowing attackers to inject and execute arbitrary OS commands via the scheduler configuration.

Executive Summary:
A critical privilege management flaw in the Grav API plugin enables unauthenticated attackers to achieve remote code execution through command injection.

Vulnerability Details

CVE-ID: CVE-2026-72830

Affected Software: getgrav Grav

Affected Versions: 0 up to 1.0.13

Vulnerability: The vulnerability stems from improper privilege management within the ConfigController. Unauthenticated attackers can leverage scoped API keys to modify scheduler jobs, resulting in arbitrary OS command execution.

Business Impact

This flaw permits full remote code execution, which allows an attacker to compromise the underlying operating system. The ability to execute arbitrary commands poses a severe threat to business operations, data privacy, and overall infrastructure security. The CVSS score of 9.8 reflects the high potential for total system compromise.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.13 or later to enforce proper scope validation.

Proactive Monitoring: Audit scheduler configuration files for unauthorized or unexpected job entries.

Compensating Controls: Use a Web Application Firewall to inspect and block suspicious API calls targeting configuration endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous as it allows for direct command injection on the host system.

Analyst Recommendation

Given the critical nature of this vulnerability, immediate remediation is required. Security teams should verify that all Grav instances are updated to version 1.0.13 or higher to prevent potential exploitation.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav API plugin contains a flaw in UsersController that allows attackers to bypass scope caps and promote accounts to super-user status.

Executive Summary:
A critical privilege management flaw in the Grav API plugin enables unauthenticated attackers to promote accounts to super-user status, leading to total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72829

Affected Software: getgrav Grav

Affected Versions: 0 up to (excluding) 1.0.13

Vulnerability: This is an improper privilege management vulnerability (CWE-269) where the system performs an insufficient check on administrative grants. The application fails to verify the API key scopes before allowing promotion to super-user privileges.

Business Impact

The ability to elevate any account to super-user status grants an attacker full control over the application. With a CVSS score of 9.8, this vulnerability allows for data exfiltration, administrative manipulation, and potential persistence mechanisms that threaten the entire business operation.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later immediately.

Proactive Monitoring: Review user account lists for unauthorized administrative accounts and monitor API usage logs for unusual promotion activities.

Compensating Controls: Utilize a WAF to block unauthorized API requests and enforce the principle of least privilege by auditing existing API key capabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the bypass of critical authorization gates.

Analyst Recommendation

Given the availability of a proof-of-concept and the critical nature of the vulnerability, immediate patching is required. Administrators should verify all current user accounts for signs of unauthorized promotion following the update.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to 1.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in the getgrav grav-plugin-api allows high-privileged users to bypass API key scopes via the InvitationsController.

Executive Summary:
An improper privilege management flaw in the getgrav grav-plugin-api could allow administrative users to bypass critical security scopes.

Vulnerability Details

CVE-ID: CVE-2026-72828

Affected Software: getgrav grav

Affected Versions: 0 up to 1.0.13

Vulnerability: This vulnerability, classified as CWE-269, involves improper privilege management within the InvitationsController. The vulnerability requires an attacker to already possess high privileges, which they then use to bypass intended API key scope restrictions.

Business Impact

The CVSS score of 7.2 highlights the potential for severe impact on system confidentiality, integrity, and availability. By bypassing scope restrictions, an authenticated administrator could gain unauthorized access to data or functions outside their assigned permissions, potentially leading to a total compromise of the application environment.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later to address the underlying privilege management flaw.

Proactive Monitoring: Audit logs for any irregular administrative activity or attempts to access administrative functions that fall outside of defined API key scopes.

Compensating Controls: Regularly review and rotate API keys, and enforce the principle of least privilege for all administrative accounts to minimize the potential impact of a scope bypass.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires high privileges, the ability to bypass scope restrictions remains a significant security concern for enterprise environments.

Analyst Recommendation

While this vulnerability requires high-privileged access, it represents a significant failure in security architecture. Organizations must prioritize upgrading to version 1.0.13 to restore proper privilege management and ensure that API key scopes are strictly enforced.

---METADATA---
VENDOR: Grav
PRODUCT: Grav CMS
AFFECTED_VERSIONS: 0 up to 2.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A template engine injection vulnerability in Grav CMS allows authenticated attackers to execute arbitrary code via the Twig template engine.

Executive Summary:
A high-severity vulnerability in the Twig template engine within Grav CMS versions prior to 2.0.13 enables authenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-72827

Affected Software: Grav CMS

Affected Versions: 0 up to 2.0.13

Vulnerability: This vulnerability (CWE-1336) arises from the improper neutralization of special elements used in the Twig template engine. Authenticated attackers can leverage this flaw to manipulate templates and execute unauthorized code within the application context.

Business Impact

A CVSS score of 8.8 underscores the gravity of this issue, as it grants attackers the ability to compromise the integrity and confidentiality of the entire CMS installation. Unauthorized code execution can lead to full system takeover and persistent backdoors within the web application.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.13 or later to apply the necessary template engine security fixes.

Proactive Monitoring: Monitor template file changes and review server logs for unusual Twig engine errors or unauthorized code execution attempts.

Compensating Controls: Implement a Web Application Firewall with rules designed to detect and block malicious template injection patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Template injection is a common method for attackers to achieve code execution.

Analyst Recommendation

All Grav CMS instances must be updated to version 2.0.13 to remediate this vulnerability. Given the ease of potential exploitation via template manipulation, prompt patching is essential to maintain the security posture of the web environment.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The getgrav grav-plugin-api fails to validate API key scopes during creation, allowing attackers to mint unauthorized, full-access super keys.

Executive Summary:
A critical vulnerability in the Grav API plugin allows unauthenticated attackers to escalate privileges by minting administrative API keys, posing a total risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-72826

Affected Software: getgrav Grav

Affected Versions: 0 up to (excluding) 1.0.13

Vulnerability: This is an incorrect privilege assignment vulnerability (CWE-266) within the createApiKey function. The application fails to perform a subset check on requested scopes, allowing an attacker with minimal privileges to mint a super-user key.

Business Impact

Successful exploitation results in full administrative control over the Grav instance. Given the critical CVSS score of 9.8, this flaw facilitates complete system compromise, including the potential for unauthorized configuration changes and remote code execution.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later immediately.

Proactive Monitoring: Audit existing API keys for unexpected administrative scopes and monitor system logs for suspicious key generation events.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to the API endpoints and employ strict network segmentation to limit exposure of the administrative interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of server-side validation on user-supplied scope arrays.

Analyst Recommendation

This vulnerability represents a severe security risk that enables total account takeover. Organizations must prioritize patching to version 1.0.13 to prevent unauthorized privilege escalation and ensure the integrity of the Grav environment.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to 1.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the getgrav grav-plugin-api allows authenticated users to perform unauthorized actions via the ReportsController.

Executive Summary:
An authenticated missing authorization vulnerability in the getgrav grav-plugin-api could allow unauthorized integrity impacts on the affected system.

Vulnerability Details

CVE-ID: CVE-2026-72825

Affected Software: getgrav grav

Affected Versions: 0 up to 1.0.13

Vulnerability: This vulnerability, classified as CWE-862, occurs because the application fails to perform adequate authorization checks for API requests. An attacker with low-level privileges can exploit this to perform actions they are not authorized to access.

Business Impact

With a CVSS score of 7.6, this vulnerability carries significant risk regarding the integrity of data within the Grav environment. Unauthorized access to administrative or sensitive functions could lead to data manipulation, unauthorized configuration changes, and potential service disruption, affecting the overall security posture of the platform.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later to ensure that proper authorization checks are enforced.

Proactive Monitoring: Review application logs for suspicious API calls or unexpected administrative actions performed by low-privileged user accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block suspicious API requests that attempt to access restricted controller endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is not automatable, requiring a degree of effort from the attacker.

Analyst Recommendation

Given the evidence of a proof-of-concept, prompt remediation is required to secure the Grav installation. Administrators should apply the 1.0.13 update immediately to mitigate the risk of unauthorized privilege escalation and data manipulation.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav API plugin contains an authorization bypass in PagesController that allows unauthenticated attackers to achieve server-side template injection and remote code execution.

Executive Summary:
A critical authorization bypass in the Grav API plugin allows unauthenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-72824

Affected Software: getgrav Grav

Affected Versions: 0 up to 1.0.13

Vulnerability: This vulnerability involves a missing authorization check within the PagesController::guardTwigContent function. An unauthenticated attacker can manipulate API key scopes to enable Twig processing, leading to server-side template injection and remote code execution.

Business Impact

Successful exploitation grants an attacker full control over the web server hosting the Grav instance. This can lead to complete data compromise, unauthorized modification of site content, and potential lateral movement within the network. Given the CVSS score of 9.8, the risk to confidentiality, integrity, and availability is considered critical.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.13 or later immediately.

Proactive Monitoring: Monitor server logs for unusual API requests or patterns suggesting attempted injection of Twig syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious template injection payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it allows an attacker to bypass security gates and execute server-side code.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the Grav API plugin to version 1.0.13 to eliminate the risk of remote code execution. Failure to patch may expose the system to high-impact attacks.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical authentication bypass vulnerability in the getgrav/grav-plugin-api package allows unauthorized users to disable two-factor authentication on target accounts.

Executive Summary:
An authentication bypass in the grav-plugin-api allows unauthorized users to disable two-factor authentication on target accounts, facilitating full account takeover.

Vulnerability Details

CVE-ID: CVE-2026-72822

Affected Software: getgrav grav (grav-plugin-api)

Affected Versions: 0 up to (excluding) 1.0.13

Vulnerability: The disable2fa endpoint fails to invoke necessary permission checks, allowing users with limited API access to bypass security controls. This permits the disabling of two-factor authentication on non-super accounts without requiring a TOTP code.

Business Impact

By enabling the removal of two-factor authentication, an attacker can effectively bypass the primary protection mechanism for user accounts. This facilitates account takeover, which can lead to unauthorized administrative access and potential data breaches. The CVSS score of 9.8 reflects the ease of exploitation and the high impact on account security.

Remediation Plan

Immediate Action: Update the getgrav grav-plugin-api component to version 1.0.13 or later. This version correctly enforces API key scope caps and mandatory permission checks for the disable2fa endpoint.

Proactive Monitoring: Review logs for unusual calls to the /api/v1/users/{user}/2fa/disable endpoint. Monitor for unexpected modifications to user account security settings, particularly the removal of 2FA.

Compensating Controls: Restrict access to the API endpoints via network-level controls or WAF rules if immediate patching is not feasible. Audit existing API keys to ensure they adhere to the principle of least privilege.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly critical because it directly undermines multi-factor authentication, which is a primary defensive control.

Analyst Recommendation

The ability to bypass 2FA is a major security risk that should be addressed immediately. Organizations using the Grav API plugin must update to version 1.0.13 to prevent potential account takeovers and maintain the security posture of their administrative users.

---METADATA---
VENDOR: Grav
PRODUCT: Grav CMS
AFFECTED_VERSIONS: 0 up to 2.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper control of code generation vulnerability in Grav CMS allows authenticated attackers to execute arbitrary code via malicious ZIP file uploads.

Executive Summary:
A critical remote code execution vulnerability in Grav CMS versions prior to 2.0.13 permits authenticated users to gain unauthorized command execution on the host server.

Vulnerability Details

CVE-ID: CVE-2026-72819

Affected Software: Grav CMS

Affected Versions: 0 up to 2.0.13

Vulnerability: This vulnerability, categorized as CWE-94, involves improper control of code generation during the processing of ZIP file uploads. An authenticated user with sufficient privileges can upload a crafted archive to achieve remote code execution on the underlying server.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to the entire server environment. An attacker achieving remote code execution can steal sensitive data, modify application files, or pivot deeper into the corporate network, leading to significant reputational and financial damage.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.13 or later immediately.

Proactive Monitoring: Inspect server logs for suspicious file upload activity or unexpected execution of system commands by the web server user.

Compensating Controls: Ensure that the web application directory has restricted permissions and that the web server is configured to prevent the execution of scripts in upload directories.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Remote code execution flaws are high-value targets for attackers.

Analyst Recommendation

The risk of remote code execution requires immediate attention. Organizations utilizing Grav CMS must upgrade to the patched version 2.0.13 without delay to eliminate the underlying code injection vector.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions up to v3.7.2 are vulnerable to SQL injection via the backlink/mention search query due to improper sanitization of single quotes in client-supplied search keywords.

Executive Summary:
A critical SQL injection vulnerability in SiYuan allows unauthenticated attackers to execute arbitrary SQL commands, resulting in unauthorized read and write access across the database.

Vulnerability Details

CVE-ID: CVE-2026-72811

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly neutralize single quotes within the backlink/mention search functionality, allowing attackers to break out of SQL string literals. Because the database driver supports statement stacking, this permits attackers to execute arbitrary SQL commands with the privileges of the application.

Business Impact

This vulnerability allows an attacker to manipulate the underlying database, leading to potential data exposure, data modification, or deletion of sensitive information across all notebooks. Given the CVSS score of 10.0, the impact on confidentiality, integrity, and availability is considered total, which could result in significant operational disruption and loss of proprietary data.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later immediately.

Proactive Monitoring: Review database access logs for unexpected SQL queries or signs of unauthorized data modification.

Compensating Controls: Implement strict input validation or use a WAF to filter out SQL injection patterns, such as single quotes and common SQL keywords, from search queries.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is high due to the ease of reachability on public-facing instances.

Analyst Recommendation

Organizations must prioritize updating to version 3.7.4 to remediate this critical flaw. Failure to patch leaves the system open to full database compromise, and immediate action is required to ensure the integrity of stored data.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan note-taking software is susceptible to a missing authorization vulnerability, which can be exploited via websockets to bypass security boundaries.

Executive Summary:
SiYuan versions prior to 3.7.4 contain a missing authorization vulnerability that allows unauthenticated attackers to bypass security boundaries via websocket communication.

Vulnerability Details

CVE-ID: CVE-2026-72810

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application suffers from a missing authorization flaw (CWE-862). This allows an unauthenticated attacker to interact with the application through websockets, effectively bypassing established security boundaries.

Business Impact

The lack of proper authorization mechanisms allows unauthenticated entities to interact with the application, potentially leading to unauthorized data access or system manipulation. Given the CVSS score of 8.6, this vulnerability poses a high risk to the confidentiality and integrity of the data stored within the SiYuan platform.

Remediation Plan

Immediate Action: Update the SiYuan application to version 3.7.4 or later to resolve the authorization failure.

Proactive Monitoring: Monitor websocket traffic for unusual connections or requests that do not originate from authorized client instances.

Compensating Controls: Restrict network access to the SiYuan instance to trusted IP addresses only, effectively limiting the potential attack surface while awaiting updates.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for exploitation.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability, it presents a significant risk to any exposed SiYuan instances. Administrators should apply the provided patch immediately to ensure that authorization checks are correctly enforced across all communication channels.

---METADATA---
VENDOR: Craft CMS
PRODUCT: CMS
AFFECTED_VERSIONS: 5.0.0-RC1 up to 5.10.7, 4.0.0-RC1 up to 4.18.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Craft CMS is affected by a Twig sandbox escape vulnerability, which allows an authenticated attacker to execute arbitrary code on the server.

Executive Summary:
An authenticated remote code execution vulnerability in Craft CMS poses a critical risk to server integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-72781

Affected Software: Craft CMS

Affected Versions: 5.0.0-RC1 up to 5.10.7, 4.0.0-RC1 up to 4.18.3

Vulnerability: This vulnerability involves a failure of the Twig sandbox protection mechanism (CWE-693). An authenticated user with sufficient privileges can bypass sandbox restrictions to perform arbitrary code execution on the host server.

Business Impact

Successful exploitation allows an attacker to gain full control over the web server. This facilitates unauthorized access to sensitive application data, potential lateral movement within the hosting environment, and complete system compromise. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.7 or 4.18.3 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor server access logs and system process execution for unusual activity originating from administrative or user accounts.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the web server process from executing unnecessary system commands or accessing sensitive filesystem areas.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated session, which limits the initial attack surface to existing users.

Analyst Recommendation

Given the severity of potential remote code execution, organizations must prioritize patching their Craft CMS instances. Administrative teams should verify their current version and apply the recommended updates immediately to prevent exploitation of this sandbox escape.

---METADATA---
VENDOR: Craft CMS
PRODUCT: CMS
AFFECTED_VERSIONS: 5.0.0-RC1 up to 5.10.6, 4.0.0-RC1 up to 4.18.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Craft CMS is vulnerable to remote code execution due to improper control of dynamically determined object attributes during configuration processing.

Executive Summary:
An authenticated remote code execution vulnerability in Craft CMS allows attackers to manipulate object attributes and compromise the application.

Vulnerability Details

CVE-ID: CVE-2026-72778

Affected Software: Craft CMS

Affected Versions: 5.0.0-RC1 up to 5.10.6, 4.0.0-RC1 up to 4.18.2

Vulnerability: This issue is caused by improper control of dynamically determined object attributes (CWE-915). An authenticated attacker can leverage this flaw to modify application configurations and achieve arbitrary code execution.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total system compromise. Exploitation enables an attacker to execute arbitrary commands, potentially leading to data exfiltration, unauthorized modification of site content, and complete loss of server control.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.6 or 4.18.2 to resolve the configuration injection flaw.

Proactive Monitoring: Review application configuration change logs and monitor for unexpected administrative actions that could indicate an attempt to exploit object attributes.

Compensating Controls: Utilize a Web Application Firewall to block suspicious requests containing unexpected object attribute modifications or configuration parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authentication, it provides a direct path to full system control.

Analyst Recommendation

This vulnerability represents a significant security risk for Craft CMS installations. Administrators should perform an immediate update to the patched versions provided by the vendor to eliminate the potential for remote code execution.

---METADATA---
VENDOR: DayuanJiang
PRODUCT: next-ai-draw-io
AFFECTED_VERSIONS: 0 through 0.4.16
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in next-ai-draw-io allows remote, unauthenticated attackers to perform unauthorized requests by exploiting DNS rebinding in the URL parsing logic.

Executive Summary:
The next-ai-draw-io application is vulnerable to Server-Side Request Forgery, potentially allowing attackers to access internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-72777

Affected Software: DayuanJiang next-ai-draw-io

Affected Versions: 0 through 0.4.16

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability occurring in the parse-url function. The flaw is unauthenticated, allowing remote attackers to bypass network controls and interact with internal services.

Business Impact

An attacker can leverage this vulnerability to probe internal network infrastructure, bypass firewalls, or interact with sensitive internal APIs that are not exposed to the public internet. Given the CVSS score of 8.6, this vulnerability poses a high risk to the overall network security posture by potentially exposing internal services to unauthorized interaction.

Remediation Plan

Immediate Action: As no specific patch version is listed, users should monitor the project repository for updates and restrict network access to the host running the application.

Proactive Monitoring: Review firewall and proxy logs for unusual outbound connection attempts originating from the server hosting the application.

Compensating Controls: Implement strict network segmentation or egress filtering to prevent the application server from initiating connections to sensitive internal resources.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, which increases the likelihood of opportunistic scanning by malicious actors.

Analyst Recommendation

Because this vulnerability allows an attacker to bypass network perimeters, it should be treated with high urgency. If an official patch is not yet available, organizations must apply aggressive network-level restrictions to isolate the application until a fix is released.

---METADATA---
VENDOR: Fosowl
PRODUCT: AgenticSeek
AFFECTED_VERSIONS: 0 through 2.41.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Fosowl AgenticSeek suffers from an unauthenticated remote code execution vulnerability in its query API, allowing attackers to execute arbitrary commands via crafted POST requests.

Executive Summary:
The Fosowl AgenticSeek API is susceptible to unauthenticated remote code execution, enabling attackers to gain host-level access to the affected system.

Vulnerability Details

CVE-ID: CVE-2026-72776

Affected Software: Fosowl AgenticSeek

Affected Versions: 0 through 2.41.1

Vulnerability: This is a missing authentication for a critical function (CWE-306) flaw. Attackers can submit crafted queries to the unprotected POST /query API endpoint, causing the system to execute shell commands via the BashInterpreter with safety features disabled.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the AgenticSeek application. This leads to full host-level code execution, which grants the attacker the ability to steal sensitive data, pivot into internal networks, or disrupt critical business operations. With a CVSS score of 9.8, the risk to the organization is extreme.

Remediation Plan

Immediate Action: Update Fosowl AgenticSeek to the latest patched version and ensure the API endpoint is restricted from public access.

Proactive Monitoring: Monitor network traffic for anomalous POST requests to the /query endpoint and audit system logs for unexpected subprocess execution.

Compensating Controls: Implement network-level restrictions, such as firewall rules or VPN requirements, to prevent the API from being reachable by unauthorized network-adjacent attackers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of authentication and the direct path to command execution.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it provides a direct path to host-level command execution. Organizations must apply the vendor patch immediately and ensure that the AgenticSeek service is not exposed to the public internet without robust authentication and network access controls.

---METADATA---
VENDOR: n8n-io
PRODUCT: n8n
AFFECTED_VERSIONS: 0 up to 2.32.1 (excluding 2.32.1), 0 up to 2.31.5 (excluding 2.31.5)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A weak password recovery mechanism in n8n-io n8n allows authenticated attackers to potentially bypass authentication protocols via token exchange.

Executive Summary:
A critical authentication bypass vulnerability in n8n-io n8n allows authenticated attackers to manipulate token exchange mechanisms, risking full system access.

Vulnerability Details

CVE-ID: CVE-2026-72772

Affected Software: n8n-io n8n

Affected Versions: 0 up to 2.32.1, 0 up to 2.31.5

Vulnerability: This vulnerability involves a weak password recovery mechanism (CWE-640) that can be exploited by an authenticated user to perform an authentication bypass. The vulnerability leverages flaws in the token exchange process to elevate privileges or hijack sessions.

Business Impact

With a CVSS score of 8.9, this vulnerability presents a significant risk to workflow automation security. Successful exploitation could allow an attacker to hijack active sessions or bypass authentication, granting them full control over workflows, connected credentials, and integrated third-party services.

Remediation Plan

Immediate Action: Update the n8n installation to version 2.32.1 or 2.31.5 immediately to resolve the token exchange flaw.

Proactive Monitoring: Review application and access logs for suspicious token exchange patterns or unauthorized account access events.

Compensating Controls: Restrict access to the n8n administrative interface to known IP addresses and enforce multi-factor authentication (MFA) where possible to mitigate the impact of compromised credentials.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to its potential to bypass core authentication security controls.

Analyst Recommendation

This flaw requires urgent attention due to the high severity and the potential for complete system compromise. Administrators must apply the vendor-provided patches (2.32.1 or 2.31.5) as soon as possible to secure the n8n platform against potential exploitation.

---METADATA---
VENDOR: n8n-io
PRODUCT: n8n
AFFECTED_VERSIONS: 0 up to (excluding) 1.123.67, 0 up to (excluding) 2.32.1, 0 up to (excluding) 2.31.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
n8n is vulnerable to OS command injection via the Git node, which allows authenticated users to execute arbitrary commands on the underlying host.

Executive Summary:
A critical OS command injection vulnerability in the n8n Git node allows an authenticated attacker to execute arbitrary commands, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72767

Affected Software: n8n-io n8n

Affected Versions: 0 up to (excluding) 1.123.67, 2.32.1, and 2.31.5

Vulnerability: This flaw (CWE-78) occurs in the Git node, where improper neutralization of special elements allows an authenticated attacker to inject and execute arbitrary OS commands on the host server.

Business Impact

Exploitation of this vulnerability grants an attacker the ability to run arbitrary commands with the privileges of the n8n service, which can lead to data theft, lateral movement, or complete system takeover. With a CVSS score of 8.7, this vulnerability represents a high-risk scenario for organizations utilizing the Git integration in their workflows.

Remediation Plan

Immediate Action: Update n8n to version 1.123.67, 2.32.1, or 2.31.5 as appropriate for your current deployment branch.

Proactive Monitoring: Review audit logs for suspicious Git-related operations and monitor for unusual child processes spawned by the n8n application.

Compensating Controls: If immediate patching is not feasible, restrict user access to the Git node functionality and ensure the application is running in a highly restricted, non-privileged container environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable if a user can manipulate input parameters passed to the Git node.

Analyst Recommendation

Administrators must treat this vulnerability with high urgency. Applying the provided updates is the only effective way to remediate this command injection risk and ensure the continued security of the host infrastructure.

---METADATA---
VENDOR: n8n-io
PRODUCT: n8n
AFFECTED_VERSIONS: 0 up to (excluding) 2.32.1, 0 up to (excluding) 2.31.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
n8n is vulnerable to a sandbox escape that allows authenticated users to perform remote code execution.

Executive Summary:
A critical remote code execution vulnerability exists in n8n due to an improper expression sandbox escape, which could allow an authenticated attacker to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72765

Affected Software: n8n-io n8n

Affected Versions: 0 up to (excluding) 2.32.1 and 0 up to (excluding) 2.31.5

Vulnerability: This vulnerability involves a code injection flaw (CWE-94) within the expression sandbox, which permits an authenticated user with low privileges to bypass security restrictions and execute arbitrary system commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to compromise the host server, potentially leading to full system takeover and unauthorized access to sensitive workflow data. Given the CVSS score of 8.7, this is a high-severity issue that poses a significant risk to the confidentiality, integrity, and availability of the affected environment.

Remediation Plan

Immediate Action: Update n8n to version 2.32.1 or 2.31.5 immediately to incorporate the necessary sandbox security patches.

Proactive Monitoring: Monitor server logs for unexpected process execution or abnormal outbound network connections originating from the n8n application service.

Compensating Controls: Ensure the n8n instance is running with the least privilege necessary, and consider isolating the application within a containerized environment with restricted egress traffic to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for sandbox escape, which bypasses intended security boundaries.

Analyst Recommendation

The severity of this remote code execution vulnerability necessitates immediate action. Administrators must prioritize updating to the specified patched versions to prevent potential compromise of their n8n automation infrastructure.