https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-24841.htmlhttps://patchthecve.com/cve/CVE-2026-24841.htmlWed, 17 Jun 2026 10:23:41 +0000CRITICAL 9.9: Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands withohttps://patchthecve.com/cve/CVE-2026-24840.htmlhttps://patchthecve.com/cve/CVE-2026-24840.htmlWed, 17 Jun 2026 10:23:41 +0000HIGH 8.0: Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating the database container. This means that nearly all Dokphttps://patchthecve.com/cve/CVE-2026-24839.htmlhttps://patchthecve.com/cve/CVE-2026-24839.htmlWed, 17 Jun 2026 10:23:40 +0000MEDIUM 4.7: Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into perfohttps://patchthecve.com/cve/CVE-2025-53825.htmlhttps://patchthecve.com/cve/CVE-2025-53825.htmlWed, 17 Jun 2026 09:38:59 +0000CRITICAL 9.4: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This exhttps://patchthecve.com/cve/CVE-2025-53376.htmlhttps://patchthecve.com/cve/CVE-2025-53376.htmlWed, 17 Jun 2026 09:38:07 +0000HIGH 8.8: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the attackehttps://patchthecve.com/cve/CVE-2025-53375.htmlhttps://patchthecve.com/cve/CVE-2025-53375.htmlMon, 19 Oct 2026 17:10:00 +0000MEDIUM 6.5: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credhttps://patchthecve.com/cve/CVE-2025-53374.htmlhttps://patchthecve.com/cve/CVE-2025-53374.htmlWed, 17 Jun 2026 09:38:06 +0000MEDIUM 4.3: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The respo