CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-05-30 (6)

2026-05-30 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-05-30

6 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-45663 — 9.9 — Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When an authenticated user uploads a file to a conta…
  • CVE-2026-45625 — 9.9 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/s…
  • CVE-2026-45633 — 9.9 — Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are…
  • CVE-2026-47744 — 9.9 — Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() …
  • CVE-2026-45628 — 9.6 — Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /b…
  • CVE-2026-48501 — 9.1 — GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh releas…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.