CVE Vulnerability Catalog

Dokploy before version 0.29.13 contains a command injection vulnerability in writeTraefikConfigRemote, where user-controlled Traefik configuration is interpolated into an echo command executed via execAsyncRemote. Single quotes in redirect regex, usernames, domains, or middleware configuration can break shell quoting and execute arbitrary commands on remote servers. This is an incomplete fix for CVE-2026-45630.

Dokploy before version 0.29.13 contains a command injection vulnerability in the backup.restoreBackupWithLogs subscription, where databaseName and backupFile fields are interpolated into database restore commands without proper separation from shell syntax. An authenticated user with backup-restore permission can inject operating system commands executed in the Dokploy host context.

The use-reducer-async library contained malicious commits in the default branch between 2026-05-18 and 2026-05-19 that executed remotely controlled code during `npm install`. The code fetched a JavaScript payload from an external server, disabled TLS verification, and executed it with the user's privileges. The attack targeted developer machines, skipping CI and cloud environments.

Jaspersoft JasperReports Server contains an unauthenticated XML External Entity (XXE) vulnerability. Affected versions are from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

The use-context-selector library contained malicious commits that executed remote code during npm install. The code was removed by force-push, but local clones and forks may still contain it, and npm install against an affected checkout will still execute the code.

Metacat versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint in the legacy 1.x API. An attacker can read any file accessible to the Tomcat process by sending a single GET request, as path validation is missing and the permission check is commented out.

The OpenCart v4.2.0.0 extension installer does not validate that extracted paths stay within the intended directory. An attacker can craft a malicious extension with path traversal sequences to write files, such as a PHP web shell, into the webroot.

ReadyEcommerce before 4.5.2 has an unauthenticated SQL injection in the product listing API, where the rating parameter is concatenated into a MySQL HAVING clause without parameterization. Attackers can perform time-based blind SQL injection to extract the full database, including user credentials and admin password hashes.

In the Linux kernel, the xfrm subsystem has a vulnerability where skb->prev becomes stale after async crypto steals a GSO segment. If the last segment is stolen, the head's ->prev pointer is not updated, leading to a write through a dangling pointer (use-after-free) in validate_xmit_skb_list(). The fix repoints skb->prev at the last retained segment before returning.

In the Linux kernel, the SMB client has a vulnerability in the fallocate function that can skip holes when the server returns an allocated range starting before the current offset. This can cause later writes to the skipped area to fail with ENOSPC.

In the Linux kernel on s390 architecture, there is a vulnerability in csum_partial() that on machines without vector facility calculates the checksum from address zero instead of the source buffer. This results in incorrect checksums.

In the Linux kernel, the SMB server (ksmbd) has a use-after-free vulnerability during asynchronous oplock break notification. The pointer to the ksmbd_conn structure is stored in an async work without proper reference counting, which can lead to access to freed memory.

In the Linux kernel, the SMB client's parse_dfs_referrals() did not validate the PathConsumed value in DFS responses. A malicious response with an oversized PathConsumed can cause subsequent DFS path parsing to advance beyond the end of the path.

In the Linux kernel, the AMT (Automatic Multicast Tunneling) module has a use-after-free vulnerability. Several packet receive and transmit paths cache a pointer to the skb header and then call functions that can reallocate the head, leaving the pointer dangling. An attacker could exploit this to escalate privileges or leak information.

In the Linux kernel SCTP subsystem, sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, bypassing authentication verification. The fix checks sctp_auth_recv_cid() in such cases and drops the chunk if authentication is required.

In the Linux kernel, a vulnerability was found in the MPTCP implementation, involving a stale skb->sk pointer to a closing subflow. The backlog cleanup was performed without proper synchronization, which could lead to a use-after-free condition.

In the Linux kernel, SCTP UDP tunnel sockets were not closed during network namespace teardown, potentially leading to races and improper state. The fix closes these sockets in sctp_ctrlsock_exit() after unregistering the sysctl table.

In the Linux kernel, a pre-auth out-of-bounds read vulnerability was found in ceph_handle_caps(). An attacker or compromised MDS can set snaptrace_len to 0xFFFFFFFF, leading to reads beyond the message buffer and further out-of-bounds reads.

In the Linux kernel's libceph module, the length of pg_temp, pg_upmap, and pg_upmap_items lists was not bounded to CEPH_PG_MAX_SIZE, potentially leading to a stack out-of-bounds write. The fix rejects entries longer than 32 during decoding.

In the Linux kernel's libceph module, a multiplication overflow during osdmap decoding can lead to incorrect bounds checking and out-of-bounds reads. The fix uses check_mul_overflow() to detect overflow and reject corrupted messages.