Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Sep 30, 2026Tugtainer is a self-hosted app for automating updates of Docker containers.CVE-2026-87004 · Other software · Quenary · reported by GitHubHigh 8.1
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoint using jose.jwt.get_unverified_claims() instead of jwt.decode(). This skips signature verification, audience (aud) validation, issuer (iss) validation, and expiry (exp) checking entirely. The extracted claims (email/sub/preferred_username) are then used directly as the user_id for the resulting Tugtainer session. This issue has been patched in version 1.31.3.
- Product
- tugtainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Tugtainer is a self-hosted app for automating updates of Docker containers.CVE-2026-62308 · Other software · Quenary · reported by GitHubCritical 9.1
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostnames, localhost addresses, private IP ranges, or cloud metadata addresses. This can be abused as an authenticated blind server-side request forgery (SSRF). This issue has been patched in version 1.30.6.
- Product
- tugtainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Tugtainer is a self-hosted app for automating updates of Docker containers.CVE-2026-55494 · Other software · Quenary · reported by GitHubCritical 9.8
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verification function returns successfully if Config.AGENT_SECRET is empty. This causes protected Agent APIs to become accessible without authentication. This issue has been patched in version 1.30.4.
- Product
- tugtainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Tugtainer is a self-hosted app for automating updates of Docker containers.CVE-2026-55181 · Other software · Quenary · reported by GitHubCritical 9.4
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to /auth/oidc/login still starts the OIDC login flow, returns HTTP 302, sets an oidc_state cookie, and redirects the user to the configured OIDC authorization endpoint. This bypasses the intended OIDC disable switch. This issue has been patched in version 1.30.3.
- Product
- tugtainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Tugtainer is a self-hosted app for automating updates of Docker containers.CVE-2026-47752 · Other software · Quenary · reported by GitHubCritical 9.9
Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Version 1.30.2 fixes the issue.
- Product
- tugtainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Tugtainer is a self-hosted app for automating updates of Docker containers.CVE-2026-23846 · Other software · Quenary · reported by GitHubHigh 8.1
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
- Product
- tugtainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Tugtainer is a self-hosted app for automating updates of docker containers.CVE-2025-69201 · Other software · Quenary · reported by GitHubHigh 8.1
Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue.
- Product
- tugtainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.