Approved changes feed: RSS · Atom
cpe:2.3:a:quenary:tugtainer:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Quenary (51a0c8b2-611f-513e-b130-19b9a0ee3f98) |
|---|---|
| Product | Tugtainer (91b967af-9312-5227-9e4c-82df99c71af8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/quenary/tugtainer |
purl2cpe | 2026-07-28 16:40:49.430028 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-47752 |
vulnerable | 2026-07-29 00:55:00.396536 |
Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution
CRITICAL (9.9)
Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Version 1.30.2 fixes the issue.
Published: 2026-07-23T16:57:54.967Z
Updated: 2026-07-23T17:43:09.688Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23846 |
vulnerable | 2026-06-08 07:51:16.335597 |
Tugtainer vulnerable to Password Exposure via URL Query Parameter
HIGH (8.1)
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
Published: 2026-01-19T19:42:35.581Z
Updated: 2026-01-20T14:40:03.105Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-69201 |
vulnerable | 2026-06-08 07:41:22.178335 |
Tugtainer has RCE in Agent Command Execution Api
Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue.
Published: 2025-12-29T15:51:41.461Z
Updated: 2025-12-29T16:50:49.919Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.