[ Vendor · 9 CVEs ]
Finsys
CVEs affecting Finsys published in the last 30 days, plus any Finsys CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-113354 | 20 Oct 2026 | CVSS 6.5 | Finsys dockhandDockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through… | |
| CVE-2026-57169 | 16 Oct 2026 | CVSS 9.6 | Finsys dockhandDockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce… | |
| CVE-2026-110254 | 13 Oct 2026 | CVSS 4.3 | Finsys dockhandFinsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts… | |
| CVE-2026-110255 | 13 Oct 2026 | CVSS 8.5 | Finsys dockhandFinsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the… | |
| CVE-2026-110256 | 13 Oct 2026 | CVSS 3.7 | Finsys dockhandFinsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the… | |
| CVE-2026-110112 | 13 Oct 2026 | CVSS 8.1 | Finsys dockhandDockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss… | |
| CVE-2026-110130 | 13 Oct 2026 | CVSS 10.0 | Finsys dockhandDockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset… | |
| CVE-2026-53988 | 29 Sep 2026 | CVSS 10.0 | Finsys dockhandDockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to… | |
| CVE-2026-53989 | 29 Sep 2026 | CVSS 4.7 | Finsys dockhandDockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to… |