Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities by VPS.org

    CVE-2026-16504 (GCVE-0-2026-16504)

    Vulnerability from nvd – Published: 2026-07-31 15:19 – Updated: 2026-07-31 15:19
    VLAI
    Title
    VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
    Summary
    Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
    Severity
    No CVSS data available.
    CWE
    • CWE-1188 - Initialization of a Resource with an Insecure Default
    • CWE-321 - Use of Hard-coded Cryptographic Key
    • CWE-1393 - Use of Default Password
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Zulip template",
          "vendor": "VPS.org",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1188: Initialization of a Resource with an Insecure Default",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-321: Use of Hard-coded Cryptographic Key",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-1393: Use of Default Password",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T15:19:42.435Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/243636"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16504"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-16504",
    "datePublished": "2026-07-31T15:19:42.435Z",
    "dateReserved": "2026-07-21T19:08:55.664Z",
    "dateUpdated": "2026-07-31T15:19:42.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16503 (GCVE-0-2026-16503)

    Vulnerability from nvd – Published: 2026-07-31 15:18 – Updated: 2026-07-31 15:18
    VLAI
    Title
    VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
    Summary
    Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
    Severity
    No CVSS data available.
    CWE
    • CWE-1327 - Binding to an Unrestricted IP Address
    • CWE-1393 - Use of Default Password
    • CWE-1188 - Initialization of a Resource with an Insecure Default
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Supabase template",
          "vendor": "VPS.org",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to \"postgres\". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1327: Binding to an Unrestricted IP Address",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-1393: Use of Default Password",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-1188: Initialization of a Resource with an Insecure Default",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T15:18:33.052Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/243636"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16503"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-16503",
    "datePublished": "2026-07-31T15:18:33.052Z",
    "dateReserved": "2026-07-21T19:08:29.074Z",
    "dateUpdated": "2026-07-31T15:18:33.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16504 (GCVE-0-2026-16504)

    Vulnerability from cvelistv5 – Published: 2026-07-31 15:19 – Updated: 2026-07-31 15:19
    VLAI
    Title
    VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
    Summary
    Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
    Severity
    No CVSS data available.
    CWE
    • CWE-1188 - Initialization of a Resource with an Insecure Default
    • CWE-321 - Use of Hard-coded Cryptographic Key
    • CWE-1393 - Use of Default Password
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Zulip template",
          "vendor": "VPS.org",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1188: Initialization of a Resource with an Insecure Default",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-321: Use of Hard-coded Cryptographic Key",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-1393: Use of Default Password",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T15:19:42.435Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/243636"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16504"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-16504",
    "datePublished": "2026-07-31T15:19:42.435Z",
    "dateReserved": "2026-07-21T19:08:55.664Z",
    "dateUpdated": "2026-07-31T15:19:42.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16503 (GCVE-0-2026-16503)

    Vulnerability from cvelistv5 – Published: 2026-07-31 15:18 – Updated: 2026-07-31 15:18
    VLAI
    Title
    VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
    Summary
    Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
    Severity
    No CVSS data available.
    CWE
    • CWE-1327 - Binding to an Unrestricted IP Address
    • CWE-1393 - Use of Default Password
    • CWE-1188 - Initialization of a Resource with an Insecure Default
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Supabase template",
          "vendor": "VPS.org",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to \"postgres\". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1327: Binding to an Unrestricted IP Address",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-1393: Use of Default Password",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-1188: Initialization of a Resource with an Insecure Default",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T15:18:33.052Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/243636"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16503"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-16503",
    "datePublished": "2026-07-31T15:18:33.052Z",
    "dateReserved": "2026-07-21T19:08:29.074Z",
    "dateUpdated": "2026-07-31T15:18:33.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}