CVE-2026-45633

CriticalCVSS 9.9/10Last modified Oct 6, 2026

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-456345.5Out-of-bounds read in Windows DHCP Server allows an authorized attacker to disclose information locally.CVE-2026-456358.1Access of resource using incompatible type ('type confusion') in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execu CVE-2026-456367.8Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.CVE-2026-456377.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-456387.8Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-456397.5Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-45644.7A security vulnerability has been detected in yangzongzhuan RuoYi up to 4.8.2. This issue affects some unknown processing of the file /monit CVE-2026-456407.0Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.CVE-2026-456417.8Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker to execute code locally.CVE-2026-456423.9Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perf CVE-2026-456437.8Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-456448.0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized