VPS.org vulnerabilities
We track 2 vulnerabilities in VPS.org products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 31, 2026.
2vulnerabilities
2critical
0high
0exploited
9.4average CVSS score
Latest VPS.org vulnerabilities
- 9.8 Critical severity
Zulip template: Use of Hard-coded Cryptographic Key
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
- 9.1 Critical severity
Supabase template: Initialization of a Resource with an Insecure Default
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a