{"schema_version":1,"title":"Dokploy vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 25 vulnerabilities in Dokploy: 2 in the last 7 days and 14 in the last 90 days, 19 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93425, was published on 24 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/dokploy","json_url":"https://junglewise.ai/threats/vendors/dokploy.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/dokploy","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":3,"all_time":25,"critical":19,"exploited":0,"last_7_days":2,"last_30_days":3,"last_90_days":14,"last_365_days":25},"latest":[{"cve":"CVE-2026-93425","cvss":9.9,"epss":0.0062,"slug":"cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior","title":"Dokploy OS command injection in patch repository read","severity":"critical","exploited":false,"published_at":"2026-09-24T16:17:25.99+00:00","url":"https://junglewise.ai/threats/cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior"},{"cve":"CVE-2026-86059","cvss":9.6,"epss":0.0049,"slug":"cve-2026-86059-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior","title":"Dokploy credential disclosure in provider APIs","severity":"critical","exploited":false,"published_at":"2026-09-22T17:17:27.69+00:00","url":"https://junglewise.ai/threats/cve-2026-86059-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior"},{"cve":"CVE-2026-82954","cvss":9.9,"epss":0.0096,"slug":"cve-2026-82954-dokploy-path-traversal-in-traefik-configuration","title":"Dokploy path traversal in Traefik configuration","severity":"critical","exploited":false,"published_at":"2026-08-31T22:17:34.08+00:00","url":"https://junglewise.ai/threats/cve-2026-82954-dokploy-path-traversal-in-traefik-configuration"},{"cve":"CVE-2026-45791","cvss":5.9,"epss":0.0041,"slug":"cve-2026-45791-dokploy-session-invalidation-bypass-in-password-change","title":"Dokploy session invalidation bypass in password change","severity":"medium","exploited":false,"published_at":"2026-08-17T22:17:14.333+00:00","url":"https://junglewise.ai/threats/cve-2026-45791-dokploy-session-invalidation-bypass-in-password-change"},{"cve":"CVE-2026-45790","cvss":8,"epss":0.0042,"slug":"cve-2026-45790-dokploy-privilege-escalation-via-organization-invitemember","title":"Dokploy privilege escalation via organization.inviteMember","severity":"high","exploited":false,"published_at":"2026-08-17T22:17:14.17+00:00","url":"https://junglewise.ai/threats/cve-2026-45790-dokploy-privilege-escalation-via-organization-invitemember"},{"cve":"CVE-2026-72862","cvss":9.9,"epss":0.0063,"slug":"cve-2026-72862-dokploy-os-command-injection-in-database-service-deployments","title":"Dokploy OS command injection in database service deployments","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:53.047+00:00","url":"https://junglewise.ai/threats/cve-2026-72862-dokploy-os-command-injection-in-database-service-deployments"},{"cve":"CVE-2026-72740","cvss":9.9,"epss":0.0079,"slug":"cve-2026-72740-dokploy-os-command-injection-in-git-clone-deployment","title":"Dokploy OS command injection in git clone deployment","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:52.723+00:00","url":"https://junglewise.ai/threats/cve-2026-72740-dokploy-os-command-injection-in-git-clone-deployment"},{"cve":"CVE-2026-72739","cvss":6.5,"epss":0.0063,"slug":"cve-2026-72739-dokploy-command-injection-via-compose-name","title":"Dokploy command injection via compose name","severity":"medium","exploited":false,"published_at":"2026-08-10T18:18:52.577+00:00","url":"https://junglewise.ai/threats/cve-2026-72739-dokploy-command-injection-via-compose-name"},{"cve":"CVE-2026-72738","cvss":9.9,"epss":0.0079,"slug":"cve-2026-72738-dokploy-backup-listbackupfiles-command-injection","title":"Dokploy backup.listBackupFiles command injection","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:52.43+00:00","url":"https://junglewise.ai/threats/cve-2026-72738-dokploy-backup-listbackupfiles-command-injection"},{"cve":"CVE-2026-72737","cvss":9.6,"epss":0.0035,"slug":"cve-2026-72737-dokploy-backup-cross-organization-idor-in-destination-handling","title":"Dokploy backup cross-organization IDOR in destination handling","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:52.28+00:00","url":"https://junglewise.ai/threats/cve-2026-72737-dokploy-backup-cross-organization-idor-in-destination-handling"},{"cve":"CVE-2026-72736","cvss":9.9,"epss":0.0063,"slug":"cve-2026-72736-dokploy-os-command-injection-in-cluster-and-registry-operations","title":"Dokploy OS command injection in cluster and registry operations","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:52.123+00:00","url":"https://junglewise.ai/threats/cve-2026-72736-dokploy-os-command-injection-in-cluster-and-registry-operations"},{"cve":"CVE-2026-72735","cvss":9.9,"epss":0.0093,"slug":"cve-2026-72735-dokploy-command-injection-in-traefik-configuration","title":"Dokploy command injection in Traefik configuration","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:51.977+00:00","url":"https://junglewise.ai/threats/cve-2026-72735-dokploy-command-injection-in-traefik-configuration"},{"cve":"CVE-2026-72734","cvss":8.4,"epss":0.0039,"slug":"cve-2026-72734-dokploy-server-remove-authorization-bypass","title":"Dokploy server.remove authorization bypass","severity":"high","exploited":false,"published_at":"2026-08-10T18:18:51.823+00:00","url":"https://junglewise.ai/threats/cve-2026-72734-dokploy-server-remove-authorization-bypass"},{"cve":"CVE-2026-72733","cvss":9.9,"epss":0.0072,"slug":"cve-2026-72733-dokploy-os-command-injection-in-database-backup-restore","title":"Dokploy OS command injection in database backup/restore","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:51.673+00:00","url":"https://junglewise.ai/threats/cve-2026-72733-dokploy-os-command-injection-in-database-backup-restore"},{"cve":"CVE-2026-45661","cvss":9.9,"slug":"cve-2026-45661-dokploy-path-traversal-in-application-deployment","title":"Dokploy path traversal in application deployment","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:11.78+00:00","url":"https://junglewise.ai/threats/cve-2026-45661-dokploy-path-traversal-in-application-deployment"},{"cve":"CVE-2026-45633","cvss":9.9,"slug":"cve-2026-45633-dokploy-command-injection-in-docker-container-logs-websocket","title":"Dokploy command injection in docker-container-logs WebSocket","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:11.51+00:00","url":"https://junglewise.ai/threats/cve-2026-45633-dokploy-command-injection-in-docker-container-logs-websocket"},{"cve":"CVE-2026-45632","cvss":9.9,"slug":"cve-2026-45632-dokploy-authorization-bypass-and-rce-in-schedule-router","title":"Dokploy authorization bypass and RCE in schedule router","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:11.373+00:00","url":"https://junglewise.ai/threats/cve-2026-45632-dokploy-authorization-bypass-and-rce-in-schedule-router"},{"cve":"CVE-2026-45631","cvss":10,"slug":"cve-2026-45631-dokploy-hardcoded-authentication-secret-allows-admin-takeover","title":"Dokploy hardcoded authentication secret allows admin takeover","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:11.243+00:00","url":"https://junglewise.ai/threats/cve-2026-45631-dokploy-hardcoded-authentication-secret-allows-admin-takeover"},{"cve":"CVE-2026-45630","cvss":9,"slug":"cve-2026-45630-dokploy-os-command-injection-in-updatetraefikconfig","title":"Dokploy OS command injection in updateTraefikConfig","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:11.103+00:00","url":"https://junglewise.ai/threats/cve-2026-45630-dokploy-os-command-injection-in-updatetraefikconfig"},{"cve":"CVE-2026-45629","cvss":9.9,"slug":"cve-2026-45629-dokploy-os-command-injection-in-listen-deployment-websocket","title":"Dokploy OS command injection in listen-deployment WebSocket","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:10.953+00:00","url":"https://junglewise.ai/threats/cve-2026-45629-dokploy-os-command-injection-in-listen-deployment-websocket"},{"cve":"CVE-2026-45628","cvss":9.6,"slug":"cve-2026-45628-dokploy-command-injection-in-deployment-pipeline","title":"Dokploy command injection in deployment pipeline","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:10.807+00:00","url":"https://junglewise.ai/threats/cve-2026-45628-dokploy-command-injection-in-deployment-pipeline"},{"cve":"CVE-2026-43917","cvss":5.3,"slug":"cve-2026-43917-dokploy-cross-organization-idor-in-multiple-trpc-endpoints","title":"Dokploy cross-organization IDOR in multiple tRPC endpoints","severity":"info","exploited":false,"published_at":"2026-05-29T18:17:09.55+00:00","url":"https://junglewise.ai/threats/cve-2026-43917-dokploy-cross-organization-idor-in-multiple-trpc-endpoints"},{"cve":"CVE-2026-45663","cvss":9.9,"slug":"cve-2026-45663-dokploy-command-injection-in-docker-file-upload-functionality","title":"Dokploy command injection in Docker file upload functionality","severity":"critical","exploited":false,"published_at":"2026-05-29T16:16:28.347+00:00","url":"https://junglewise.ai/threats/cve-2026-45663-dokploy-command-injection-in-docker-file-upload-functionality"},{"cve":"CVE-2026-45662","cvss":8.8,"slug":"cve-2026-45662-dokploy-command-injection-in-deleteregistry-function","title":"Dokploy command injection in deleteRegistry function","severity":"high","exploited":false,"published_at":"2026-05-29T16:16:28.213+00:00","url":"https://junglewise.ai/threats/cve-2026-45662-dokploy-command-injection-in-deleteregistry-function"},{"cve":"CVE-2026-27130","cvss":9.9,"slug":"cve-2026-27130-dokploy-os-command-injection-in-appname-parameter","title":"Dokploy OS command injection in appName parameter","severity":"critical","exploited":false,"published_at":"2026-05-18T21:16:39.89+00:00","url":"https://junglewise.ai/threats/cve-2026-27130-dokploy-os-command-injection-in-appname-parameter"}],"vendor":{"hub":true,"name":"Dokploy","slug":"dokploy","homepage":"https://dokploy.com/","description":"Dokploy is an open-source deployment tool used to manage applications and databases on servers.","url":"https://junglewise.ai/threats/vendors/dokploy"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":7,"exploited":0,"vulnerabilities":9},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":2,"exploited":0,"vulnerabilities":2}],"most_severe":[{"cve":"CVE-2026-45631","cvss":10,"slug":"cve-2026-45631-dokploy-hardcoded-authentication-secret-allows-admin-takeover","title":"Dokploy hardcoded authentication secret allows admin takeover","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:11.243+00:00","url":"https://junglewise.ai/threats/cve-2026-45631-dokploy-hardcoded-authentication-secret-allows-admin-takeover"},{"cve":"CVE-2026-82954","cvss":9.9,"epss":0.0096,"slug":"cve-2026-82954-dokploy-path-traversal-in-traefik-configuration","title":"Dokploy path traversal in Traefik configuration","severity":"critical","exploited":false,"published_at":"2026-08-31T22:17:34.08+00:00","url":"https://junglewise.ai/threats/cve-2026-82954-dokploy-path-traversal-in-traefik-configuration"},{"cve":"CVE-2026-72735","cvss":9.9,"epss":0.0093,"slug":"cve-2026-72735-dokploy-command-injection-in-traefik-configuration","title":"Dokploy command injection in Traefik configuration","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:51.977+00:00","url":"https://junglewise.ai/threats/cve-2026-72735-dokploy-command-injection-in-traefik-configuration"},{"cve":"CVE-2026-72740","cvss":9.9,"epss":0.0079,"slug":"cve-2026-72740-dokploy-os-command-injection-in-git-clone-deployment","title":"Dokploy OS command injection in git clone deployment","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:52.723+00:00","url":"https://junglewise.ai/threats/cve-2026-72740-dokploy-os-command-injection-in-git-clone-deployment"},{"cve":"CVE-2026-72738","cvss":9.9,"epss":0.0079,"slug":"cve-2026-72738-dokploy-backup-listbackupfiles-command-injection","title":"Dokploy backup.listBackupFiles command injection","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:52.43+00:00","url":"https://junglewise.ai/threats/cve-2026-72738-dokploy-backup-listbackupfiles-command-injection"},{"cve":"CVE-2026-72733","cvss":9.9,"epss":0.0072,"slug":"cve-2026-72733-dokploy-os-command-injection-in-database-backup-restore","title":"Dokploy OS command injection in database backup/restore","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:51.673+00:00","url":"https://junglewise.ai/threats/cve-2026-72733-dokploy-os-command-injection-in-database-backup-restore"},{"cve":"CVE-2026-72862","cvss":9.9,"epss":0.0063,"slug":"cve-2026-72862-dokploy-os-command-injection-in-database-service-deployments","title":"Dokploy OS command injection in database service deployments","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:53.047+00:00","url":"https://junglewise.ai/threats/cve-2026-72862-dokploy-os-command-injection-in-database-service-deployments"},{"cve":"CVE-2026-72736","cvss":9.9,"epss":0.0063,"slug":"cve-2026-72736-dokploy-os-command-injection-in-cluster-and-registry-operations","title":"Dokploy OS command injection in cluster and registry operations","severity":"critical","exploited":false,"published_at":"2026-08-10T18:18:52.123+00:00","url":"https://junglewise.ai/threats/cve-2026-72736-dokploy-os-command-injection-in-cluster-and-registry-operations"},{"cve":"CVE-2026-93425","cvss":9.9,"epss":0.0062,"slug":"cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior","title":"Dokploy OS command injection in patch repository read","severity":"critical","exploited":false,"published_at":"2026-09-24T16:17:25.99+00:00","url":"https://junglewise.ai/threats/cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior"},{"cve":"CVE-2026-45661","cvss":9.9,"slug":"cve-2026-45661-dokploy-path-traversal-in-application-deployment","title":"Dokploy path traversal in application deployment","severity":"critical","exploited":false,"published_at":"2026-05-29T18:17:11.78+00:00","url":"https://junglewise.ai/threats/cve-2026-45661-dokploy-path-traversal-in-application-deployment"}],"generated_at":"2026-09-26T12:07:00.15149+00:00","technologies":[{"name":"Dokploy","slug":"dokploy","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/dokploy"}]}