Vulnerabilities in coollabsio

71 results
Vexday analysis

A Coollabs acumula 71 vulnerabilidades no histórico, com 46 publicadas nos últimos 90 dias, indicando ritmo acelerado de descobertas. Embora nenhuma esteja sob exploração ativa no momento, 19 são classificadas como críticas, predominantemente relacionadas a injeção de comandos (CWE-78), o que representa risco significativo se explorado. A concentração recente de divulgações requer monitoramento atento e priorização de patches críticos.

CVE-2025-22605HIGHCoolify OS Command Injection Vulnerability in SSH Command GenerationEPSS 0.5%CVE-2025-64420CRITICALCoolify members can see private key of root userEPSS 0.5%CVE-2025-59158CRITICALCoolify has Stored XSS in Project NameEPSS 0.5%CVE-2025-22611CRITICALCoolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)EPSS 0.5%CVE-2026-34047CRITICALCoolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code ExecutionEPSS 0.4%CVE-2026-42143HIGHCoolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed ServersEPSS 0.4%CVE-2026-34153HIGHCoolify LocalFileVolume fs_path command injection enables RCEEPSS 0.4%CVE-2026-34034HIGHCoolify: Host RCE via Sentinel token injectionEPSS 0.4%CVE-2026-34168HIGHCoolify: Command injection via unsanitized persistent storage name in docker volume commandsEPSS 0.4%CVE-2025-22610MEDIUMCoolify Vulnerable to OAuth Secrets LeakEPSS 0.4%CVE-2026-34152HIGHCoolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)EPSS 0.4%CVE-2025-64425HIGHCoolify has host header injection in forgot passwordEPSS 0.4%CVE-2026-42153HIGHCoolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in ContainerEPSS 0.4%CVE-2026-42204HIGHCoolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host rootEPSS 0.4%CVE-2026-34158HIGHCoolify: Command injection via single-quote breakout in Docker Compose custom commandsEPSS 0.4%CVE-2025-22608MEDIUMCoolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)EPSS 0.4%CVE-2026-34058HIGHCoolify: OS Command Injection via Unmanaged Container Operations - Remote Code ExecutionEPSS 0.4%CVE-2026-34057HIGHCoolify: Authenticated Remote Code Execution via Command Injection in Database Import Container NameEPSS 0.3%CVE-2026-34035HIGHCoolify: Host RCE via Log Drain secret/env command injectionEPSS 0.3%CVE-2025-64423HIGHCoolify has a Privilege Escalation - low privileged users can see and use admin invitation linksEPSS 0.3%