🚨 CVE-2026-72737
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's service host, read that organization's backup objects, or redirect and poison backups across tenant boundaries.

🎖@cveNotify

🚨 CVE-2026-72877
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker() in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with application create or update permission can use shell command substitution in dockerImage to execute arbitrary commands on the local build host or a remote SSH build target, exposing host secrets and other projects. This issue is fixed in version 0.29.13.

🎖@cveNotify

🚨 CVE-2026-72901
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process.exec, with Docker socket access making execution host/root-equivalent. This issue is fixed in version 0.29.13.

🎖@cveNotify

🚨 CVE-2026-72907
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.

🎖@cveNotify

🚨 CVE-2026-72911
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.

🎖@cveNotify

🚨 CVE-2026-72916
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

🎖@cveNotify

🚨 CVE-2026-48046
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch.

🎖@cveNotify

🚨 CVE-2026-72921
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.

🎖@cveNotify

🚨 CVE-2026-73072
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

🎖@cveNotify

🚨 CVE-2026-65807
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

🎖@cveNotify

🚨 CVE-2026-68793
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-68794
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-68795
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-68796
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-68797
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

🎖@cveNotify

🚨 CVE-2026-68799
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

🎖@cveNotify

🚨 CVE-2026-68801
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-68802
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

🎖@cveNotify

🚨 CVE-2026-68803
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-68804
Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

🎖@cveNotify

🚨 CVE-2026-68805
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

🎖@cveNotify