VPS.org vulnerabilities
Published CVEs affecting VPS.org products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-16504
Critical · 9.8
CWE-321 Jul 31, 2026
VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
CVE-2026-16503
Critical · 9.1
CWE-1188 Jul 31, 2026
VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.