Published threat advisories for August 10, 2026

The `react18-use` project's default branch contained malicious commits that could execute remote attacker-controlled code on developer machines during `npm install`. While the malicious commits were removed and the package was not published, local clones or forks of the affected code could still pose a risk, potentiall

NVD modified: NVD date unavailable

A critical vulnerability in ERPNext allows authenticated users to inject template expressions, leading to arbitrary server-side code execution and data access. This impacts the confidentiality and integrity of application data, making it crucial to confirm the relevance and exposure of deployed instances.

NVD modified: NVD date unavailable

A critical vulnerability in Firecrawl's extraction functionality allows arbitrary file reads and server-side request forgery. An attacker can exploit this by providing a malicious JSON schema, potentially exposing sensitive files or internal systems. This issue impacts the core data processing capabilities of the appli

NVD modified: NVD date unavailable

A security vulnerability in a development tool allows attackers to execute arbitrary code on developer machines during `npm install` via malicious commits. While removed from the main branch, affected local copies could still lead to full compromise of anything reachable by the Node process. Verify developer machine ex

NVD modified: NVD date unavailable

A vulnerability in Feast allows attackers to execute arbitrary code on feature and registry servers through improperly deserialized user-defined functions. This could lead to unauthorized cross-tenant data access and lateral movement within the system.

NVD modified: NVD date unavailable

A MaaS API vulnerability allows internal applications to bypass authentication by forging HTTP headers, leading to unauthorized access and privilege escalation. This could enable an attacker to mint tokens in other namespaces, revoke API keys, or exfiltrate sensitive configurations. The issue is relevant if your enviro

NVD modified: NVD date unavailable

A vulnerability in Dokploy allows an authenticated user to execute arbitrary commands on target servers by interpolating a password field into a shell command. This could affect systems managing application deployments. The primary concern is confirming if Dokploy is in use and if it is reachable.

NVD modified: NVD date unavailable

Dokploy, a self-hostable PaaS, has a vulnerability that allows authenticated low-privilege users to run arbitrary commands on the control plane. This occurs due to improper handling of the `volumeName` field in backup operations, which, with Docker socket access, can lead to host or root-equivalent privileges. This cou

NVD modified: NVD date unavailable

A vulnerability in Dokploy, a self-hosted Platform as a Service, allows authenticated users to execute arbitrary scripts with root privileges by manipulating schedule updates. This could lead to unauthorized system access and control if the technology is in use and reachable.

NVD modified: NVD date unavailable

A vulnerability in Dokploy, a self-hostable Platform as a Service, allows an authenticated user to inject shell commands via file mounts, potentially leading to arbitrary command execution on remote managed servers. Exploitation could result in a compromise of the server's integrity and confidentiality. Readers should

NVD modified: NVD date unavailable

A critical vulnerability in Dokploy, a self-hostable PaaS, allows an authenticated user to write or delete files outside intended directories by manipulating a certificate path. This could impact the integrity and availability of managed services and the underlying system.

NVD modified: NVD date unavailable

A vulnerability exists in Dokploy, a self-hosted Platform as a Service, where an authenticated user can execute arbitrary OS commands on the server by providing malicious registry credentials. This could allow unauthorized access to host files and other containers. Dokploy is typically internet-facing, making it a pote

NVD modified: NVD date unavailable

A command injection vulnerability in Dokploy allows authenticated administrators to execute arbitrary OS commands on the host system. This occurs because user-controlled database fields are interpolated into shell commands without proper sanitization during the backup and restore process. This could lead to host system

NVD modified: NVD date unavailable

Dokploy, a self-hostable PaaS, has a vulnerability where an authenticated user with application create/update permissions can inject commands into the `dockerImage` field, potentially leading to arbitrary command execution on the build host. This could expose sensitive host secrets and other projects. The issue is fixe

NVD modified: NVD date unavailable

Dokploy, a self-hostable PaaS, has a vulnerability allowing unauthorized command execution on other tenants' servers. This could compromise server integrity and data, impacting hosted services. Confirm if your Dokploy environment is affected and assess its exposure to mitigate risks.

NVD modified: NVD date unavailable

An authentication bypass vulnerability exists in TLogger devices' web server, allowing unauthenticated attackers to access protected functionality through a specific endpoint. This could expose or modify device configuration and data, and in some cases, logging out after exploitation may crash the server.

NVD modified: NVD date unavailable

An unauthenticated SQL injection vulnerability in the TBEA TLogger web server allows remote attackers to read, modify, or delete data in the device's database. The flaw enables manipulation of SQLite queries through HTTP endpoints, potentially impacting data integrity and availability.

NVD modified: NVD date unavailable

A hard-coded root credential in TBEA TLogger's SSH service allows unauthenticated remote attackers to gain full administrative control of the device. This vulnerability, identified as critical, could lead to unauthorized system takeover and compromise of device functions. Readers should confirm the relevance and assess

NVD modified: NVD date unavailable

A critical vulnerability in Dokploy, a self-hosted PaaS, allows authenticated users with deployment permissions to execute arbitrary OS commands. This occurs due to unvalidated Bitbucket provider input, enabling potential host system compromise. Confirming its use and reachability is essential.

NVD modified: NVD date unavailable

A critical vulnerability in Dokploy allows authenticated users with backup restore permissions to execute arbitrary commands on the host system. This occurs due to improper handling of a crafted database name during the backup restore process, enabling command injection within the Docker-privileged host context. Organi

NVD modified: NVD date unavailable

A vulnerability in Dokploy, a self-hosted Platform as a Service, allows low-privileged users to execute arbitrary commands. This occurs when testing destination connections, potentially leading to unauthorized command execution within the Dokploy container and impacting the host system. Dokploy is a free, self-hostable

NVD modified: NVD date unavailable

A critical vulnerability exists in Dokploy, a self-hostable PaaS, allowing a low-privileged authenticated user to execute arbitrary host commands. This is possible because certain custom branch fields lack server-side validation and are later used in Git commands during deployments. This could impact the confidentialit

NVD modified: NVD date unavailable

A vulnerability in Dokploy, a self-hostable platform for managing deployments, allows an authenticated user with specific permissions to execute arbitrary operating-system commands on the host system by supplying a crafted path during deployment operations. This could impact the integrity and availability of the host e

NVD modified: NVD date unavailable

A vulnerability in Dokploy, a self-hostable Platform as a Service, allows authenticated users to gain root-level access to arbitrary containers on a self-hosted instance. This could lead to a significant compromise of deployed applications and services within the affected environment. The issue has been addressed in ve

NVD modified: NVD date unavailable

A vulnerability in Dokploy's WebSocket handlers allows authenticated users to gain unauthorized shell access to any container, potentially leading to root-level control of the host system. This could compromise all deployed services and tenant data.

NVD modified: NVD date unavailable

Metabase has a critical vulnerability allowing unauthenticated SQL injection through publicly shared content. This could lead to unauthorized data access or manipulation. Organizations using Metabase should assess if publicly shared cards or dashboards with field-filter parameters are exposed.

NVD modified: NVD date unavailable

Metabase is vulnerable to SQL injection through its password reset endpoint, allowing unauthenticated attackers to gain administrator access. This could lead to unauthorized control over the Metabase instance and its data.

NVD modified: NVD date unavailable

A critical vulnerability exists in Dokploy's database deployment functions where unquoted user input can lead to command injection on the remote server. This could allow an authenticated attacker to execute arbitrary commands, potentially compromising the system and its data. Organizations using Dokploy should confirm

NVD modified: NVD date unavailable

Dokploy, a self-hostable PaaS, has a critical vulnerability allowing authenticated users to run arbitrary commands on the host during deployment through specially crafted Git URLs. This could impact the host system's integrity and availability.

NVD modified: NVD date unavailable

Dokploy, a self-hostable PaaS, contains a vulnerability in its backup endpoint that allows an authenticated user with backup read permissions to execute arbitrary commands on the host. This occurs when a search parameter is processed and interpolated into a server-side command. Exploitation could lead to unauthorized c

NVD modified: NVD date unavailable

A vulnerability in Dokploy, a self-hostable Platform as a Service, allows authenticated users with backup permissions to access or poison backup data from other organizations. This occurs because the system accepts a client-controlled destination ID without proper verification of the organization associated with that d

NVD modified: NVD date unavailable

A critical vulnerability in Dokploy, a self-hosted PaaS, allows authenticated users to execute arbitrary commands remotely by sending specially crafted input to specific management endpoints. This could lead to system compromise and disruption of managed services. Confirming Dokploy's presence and exposure is crucial f

NVD modified: NVD date unavailable

A critical vulnerability in Dokploy allows authenticated users to execute arbitrary commands on managed remote servers by manipulating Traefik configuration, potentially compromising systems.

NVD modified: NVD date unavailable

Dokploy, a self-hostable PaaS, contains a critical vulnerability where an authenticated user with backup-restore permissions can inject operating-system commands into the host environment. This occurs because the backup restoration process improperly handles user-provided fields, allowing for shell command injection ev

NVD modified: NVD date unavailable

Malicious commits in the `use-reducer-async` package executed attacker-controlled code on developer machines during `npm install`. Although removed from the default branch, local clones may still be affected, potentially leading to full compromise of the developer workstation. The vulnerability targeted developer envir

NVD modified: NVD date unavailable

An unauthenticated vulnerability in Jaspersoft JasperReports Server allows improper restriction of XML external entity references, potentially enabling attackers to access or manipulate data. This issue could affect system and sensitive information when the server is reachable over a network. Technical readers and secu

NVD modified: NVD date unavailable

SPIP installations using SQLite are vulnerable to code injection via the navigation menu endpoint. An authenticated attacker with editor privileges can execute arbitrary operating system commands on the web server by sending a crafted GET request. MySQL-backed installations are not affected. You should care if your SQL

NVD modified: NVD date unavailable

A security vulnerability in a React hook allowed remote code execution on developer machines during `npm install` via malicious commits. Though removed from the main branch, these commits may exist in local clones, enabling the execution of attacker-controlled code. This issue targets developer workstations, potentiall

NVD modified: NVD date unavailable

Metacat, data repository software, has an unauthenticated path traversal vulnerability in its API that allows attackers to read any file accessible to the hosting process. This could expose sensitive research data, credentials, and system information, potentially enabling impersonation and data disclosure.

NVD modified: NVD date unavailable

An unauthenticated SQL injection vulnerability exists in the product listing API of ReadyEcommerce software. Attackers can exploit this by manipulating the rating parameter to extract sensitive database contents, including user credentials and administrator password hashes, potentially leading to unauthorized system ac

NVD modified: NVD date unavailable

A critical vulnerability in Jenkins FilePath.untarFrom() allows authenticated users to achieve remote code execution by exploiting improper validation of symbolic link targets during tar extraction. This could enable attackers to create symlinks to sensitive files, leading to the decryption of credentials and administr

NVD modified: NVD date unavailable

A vulnerability in Zyxel Networks WAH7601 allows for OS command injection, enabling an attacker to execute unauthorized commands on the device. This could lead to a compromise of its operations if the device is reachable over a network.

NVD modified: NVD date unavailable

A critical vulnerability exists in a file management tool that allows unauthenticated remote attackers to access, modify, or delete files anywhere on the server. This occurs due to a default configuration that bypasses authentication checks, granting full file management functionality without credentials.

NVD modified: NVD date unavailable

A critical vulnerability in a web file manager allows unauthenticated remote attackers to upload and execute arbitrary code by exploiting unrestricted file uploads and a lack of default authentication, potentially compromising server integrity and data.

NVD modified: NVD date unavailable

A critical OS command injection vulnerability exists in crontab-ui, allowing unauthenticated remote attackers to execute arbitrary commands by sending a crafted GET request. This could lead to system compromise if the application is reachable.

NVD modified: NVD date unavailable

An OS command injection vulnerability exists in crontab-ui, allowing unauthenticated remote attackers to execute arbitrary system commands. This is possible by importing a crafted database file, which is not validated and can lead to command execution when cron jobs run. It is uncertain if this technology is used withi

NVD modified: NVD date unavailable

An OS command injection vulnerability in Xiaomi smart speaker software allows remote attackers to execute arbitrary system commands via network requests to specific API endpoints. This could lead to device compromise if the affected software is in use and reachable.

NVD modified: NVD date unavailable

Multiple vulnerabilities in a NASA ground data system allow unauthenticated remote attackers to execute arbitrary code and inject commands to connected spacecraft. This could lead to a complete compromise of the system and any spacecraft it controls. It is uncertain if this technology is deployed or reachable in your e

NVD modified: NVD date unavailable

An improper authorization vulnerability in daptin allows unauthenticated attackers to read, create, update, and delete usergroup records by bypassing permission checks. This could lead to unauthorized access to sensitive user group information, impacting data integrity and potentially business operations if daptin is u

NVD modified: NVD date unavailable

A path traversal vulnerability in a file-serving application allows unauthenticated remote attackers to delete arbitrary files outside the intended directory when a specific delete option is enabled, due to the application not sanitizing file path inputs. This could lead to unintended data removal if the vulnerable sof

NVD modified: NVD date unavailable

An improper path validation vulnerability in deepwiki-open could allow unauthenticated remote attackers to write to or delete arbitrary files with root privileges due to inadequate sanitization of user-controlled input in API endpoints. This could impact system integrity and data.

NVD modified: NVD date unavailable

A SQL injection vulnerability exists in Tencent APIJSON, allowing unauthenticated remote attackers to read arbitrary database tables by bypassing access controls. This occurs due to an incomplete check of the "@having" operator in the APIJSONORM library. The potential impact includes unauthorized access to sensitive da

NVD modified: NVD date unavailable

An improper authorization vulnerability exists in the pangolin software, enabling authenticated remote attackers to reuse an access token for any resource across different organizations. This occurs because the system fails to verify the token against the intended target resource, potentially leading to unauthorized ac

NVD modified: NVD date unavailable

A critical vulnerability in a Joomla extension allows unauthenticated attackers to execute arbitrary code using the `ajax_calc` feature. This could compromise the integrity and availability of affected systems if the extension is deployed and reachable.

NVD modified: NVD date unavailable

The ProSolution WP Client WordPress plugin contains a critical vulnerability that may allow unauthenticated visitors to execute blind SQL injection attacks. This could lead to unauthorized access to or modification of sensitive data stored in the website's database. This issue is a concern for any WordPress site using

NVD modified: NVD date unavailable