Dokploy
48 CVEs tracked since 2026. Since May 2026, none of them reached CISA KEV.
Dokploy CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2026-05 | 11 | 0 |
| 2026-06 | null or fewer | |
| 2026-07 | null or fewer | |
| 2026-08 | 37 | 0 |
Products
The products that kept showing up in Dokploy's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Dokploy.
- CVE-2026-93425Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root9.9
- CVE-2026-86059Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one9.6
- CVE-2026-45791Dokploy: Password Change Does Not Revoke Active Sessions5.9
- CVE-2026-45790Dokploy: Invitation Role Escalation Allows Organization Takeover8.0
- CVE-2026-72902Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById9.9
- CVE-2026-72901Dokploy: Remote Code Execution via volume-backup9.9
- CVE-2026-72886Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)9.9
- CVE-2026-72885Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder—
- CVE-2026-72884Dokploy: Command Injection via Compose Custom Command—
- CVE-2026-72883Dokploy: WebSocket Terminal Missing Service-Level Access Control8.8
- CVE-2026-72882Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers9.9
- CVE-2026-72881Dokploy: Command Injection via database credentials in backup/restore commands—
- CVE-2026-72880Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`9.9
- CVE-2026-72879Dokploy: Command Injection via Registry Credentials in Swarm Upload—
- CVE-2026-72878Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments9.6
The record
- Peak rank
- #32 in Aug 2026
- Busiest month shown
- Aug 2026, 37 CVEs
- Months with a KEV entry
- 0 since May 2026
- Monthly snapshots
- 2 since 2026