Coollabsio vulnerabilities

Products

• Coolify 79

Newest

• coollabsio coolify Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints CVE-2026-121587 6.9 MediumNovember 3, 2026
• coollabsio coolify coollabsio Coolify GitHub App Setup redirect missing authentication CVE-2026-100746 6.9 MediumSeptember 27, 2026
• coollabsio coolify coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization CVE-2026-100744 6.9 MediumSeptember 27, 2026
• coollabsio coolify Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching CVE-2026-86117 9.2 CriticalSeptember 5, 2026
• coollabsio coolify Coolify before 4.2.0 Remote Code Execution via Environment Variable Key CVE-2026-84694 8.7 HighSeptember 2, 2026
• coollabsio coolify coollabsio Coolify Policy Policies authorization CVE-2026-15507 5.3 MediumJuly 12, 2026
• coollabsio coolify Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution CVE-2026-59734 Public exploit 8.8 HighJuly 9, 2026
• coollabsio coolify Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands CVE-2026-42201 3.3 LowJuly 7, 2026
• coollabsio coolify Coolify: Command injection via single-quote breakout in Docker Compose custom commands CVE-2026-34158 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL CVE-2026-34170 4.3 MediumJuly 7, 2026
• coollabsio coolify Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() CVE-2026-34037 9.9 CriticalJuly 7, 2026
• coollabsio coolify Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers CVE-2026-34048 Public exploit 9.9 CriticalJuly 7, 2026
• coollabsio coolify Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name CVE-2026-34057 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers CVE-2026-42143 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: SSRF via S3 Storage Endpoint in testConnection() CVE-2026-42147 4.9 MediumJuly 7, 2026
• coollabsio coolify Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) CVE-2026-34044 7.7 HighJuly 7, 2026
• coollabsio coolify Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) CVE-2026-34152 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs CVE-2026-34149 3.3 LowJuly 7, 2026
• coollabsio coolify Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value CVE-2026-34171 8.0 HighJuly 7, 2026
• coollabsio coolify Coolify: Host RCE via Sentinel token injection CVE-2026-34034 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: Command injection via unsanitized persistent storage name in docker volume commands CVE-2026-34168 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: File Upload Without Type or Size Validation in Database Backup Restore CVE-2026-42145 3.1 LowJuly 7, 2026
• coollabsio coolify Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing CVE-2026-34198 5.3 MediumJuly 7, 2026
• coollabsio coolify Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution CVE-2026-34058 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: Host RCE via Log Drain secret/env command injection CVE-2026-34035 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution CVE-2026-34047 9.9 CriticalJuly 7, 2026
• coollabsio coolify Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access CVE-2026-42172 3.1 LowJuly 7, 2026
• coollabsio coolify Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE CVE-2026-42200 8.8 HighJuly 7, 2026
• coollabsio coolify Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container CVE-2026-42153 8.8 HighJuly 6, 2026
• coollabsio coolify Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor CVE-2026-34167 5.0 MediumJuly 6, 2026
• coollabsio coolify Coolify: Command Injection via unsanitized MongoDB collection names in database backup CVE-2026-34049 3.3 LowJuly 6, 2026
• coollabsio coolify Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component CVE-2026-34599 8.8 HighJuly 6, 2026
• coollabsio coolify Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root CVE-2026-42204 8.8 HighJuly 6, 2026
• coollabsio coolify Coolify: Command Injection via Unescaped Version String in Docker Build CVE-2026-42148 3.8 LowJuly 6, 2026
• coollabsio coolify Coolify LocalFileVolume fs_path command injection enables RCE CVE-2026-34153 8.8 HighJuly 6, 2026
• coollabsio coolify Coolify unauthenticated feedback endpoint allows Discord webhook abuse CVE-2026-41899 6.5 MediumJuly 6, 2026
• coollabsio coolify Coolify Settings/Updates Livewire component missing instance administrator authorization CVE-2026-34050 6.5 MediumJuly 6, 2026
• coollabsio coolify Coolify read-scoped API tokens can perform state-changing validation operations CVE-2026-32718 6.5 MediumJuly 6, 2026
• coollabsio coolify Coolify authenticated remote command injection leading to RCE and secret exfiltration CVE-2026-34038 Public exploit 9.9 CriticalJuly 6, 2026
• coollabsio coolify Coolify: Authenticated RCE via command injection in CA certificate management feature CVE-2026-27957 8.8 HighJune 30, 2026
• coollabsio coolify Coolify: Cross-team application domain enumeration via domains_by_server endpoint CVE-2026-27956 4.3 MediumJune 30, 2026
• coollabsio coolify Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()` CVE-2026-27955 6.6 MediumJune 30, 2026
• coollabsio coolify Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure CVE-2026-27883 5.0 MediumJune 30, 2026
• coollabsio coolify Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) CVE-2026-27881 5.0 MediumJune 30, 2026
• coollabsio coolify Coolify: Timing Attack in GitLab Webhook Token Validation CVE-2026-27882 4.8 MediumJune 30, 2026
• coollabsio coolify Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure CVE-2026-34592 7.7 HighJune 29, 2026
• coollabsio coolify Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management CVE-2026-34594 8.8 HighJune 29, 2026
• coollabsio coolify Coolify: Authenticated Host RCE CVE-2026-34597 8.8 HighJune 29, 2026
• coollabsio coolify Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret CVE-2026-41896 7.5 HighJune 29, 2026
• coollabsio coolify Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers CVE-2026-57498 9.6 CriticalJune 29, 2026
• Show olderLoading…