dockhand
- Software type
- System management
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, dockhand recorded 11 security vulnerabilities in the last 90 days, of which 8 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of dockhand and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121449Plaintext secret disclosure in Finsys Dockhand Git-stack responsesCVE-2026-121448Dockhand before 1.0.54 Path Traversal via Stack Environment RoutesCVE-2026-113354Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentCVE-2026-57169Dockhand: Unauthenticated container exec via WebSocket upgradeCVE-2026-110256Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-121449Plaintext secret disclosure in Finsys Dockhand Git-stack responses | Exploitation statusActively exploited | FixYes |
| SeverityHigh |
CVE-2026-121448Dockhand before 1.0.54 Path Traversal via Stack Environment Routes | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-113354Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content | Exploitation statusActively exploited | FixYes | Published10/20/2026 | SeverityHigh |
|---|
CVE-2026-57169Dockhand: Unauthenticated container exec via WebSocket upgrade | Exploitation statusNot exploited | FixYes | Published10/16/2026 | SeverityCritical |
|---|
CVE-2026-110256Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth | Exploitation statusActively exploited | FixYes | Published10/13/2026 | SeverityMedium |
|---|
CVE-2026-110255Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint | Exploitation statusActively exploited | FixYes | Published10/13/2026 | SeverityHigh |
|---|
CVE-2026-110254Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory | Exploitation statusNot exploited | FixYes | Published10/13/2026 | SeverityMedium |
|---|
CVE-2026-110130Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check | Exploitation statusActively exploited | FixYes | Published10/13/2026 | SeverityCritical |
|---|
CVE-2026-110112Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation | Exploitation statusNot exploited | FixYes | Published10/13/2026 | SeverityCritical |
|---|
CVE-2026-53989Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint | Exploitation statusNot exploited | FixYes | Published09/29/2026 | SeverityMedium |
|---|
CVE-2026-53988Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints | Exploitation statusNot exploited | FixYes | Published09/29/2026 | SeverityCritical |
|---|
11 Results | Page 1 of 1