Vulnerabilities in coollabsio

71 results
Vexday analysis

A Coollabs acumula 71 vulnerabilidades no histórico, com 46 publicadas nos últimos 90 dias, indicando ritmo acelerado de descobertas. Embora nenhuma esteja sob exploração ativa no momento, 19 são classificadas como críticas, predominantemente relacionadas a injeção de comandos (CWE-78), o que representa risco significativo se explorado. A concentração recente de divulgações requer monitoramento atento e priorização de patches críticos.

CVE-2026-42201LOWCoolify: OS Command Injection via Database Credential Fields in Docker Compose Service CommandsEPSS 0.2%CVE-2026-34049LOWCoolify: Command Injection via unsanitized MongoDB collection names in database backupEPSS 0.2%CVE-2026-42172LOWCoolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent AccessEPSS 0.2%CVE-2026-27956MEDIUMCoolify: Cross-team application domain enumeration via domains_by_server endpointEPSS 0.2%CVE-2026-34170MEDIUMCoolify: Server-Side Request Forgery via attacker-controlled GitHub App API URLEPSS 0.2%CVE-2026-27881MEDIUMCoolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)EPSS 0.2%CVE-2025-22607MEDIUMCoolify Vulnerable to GitHub / GitLab OAuth Secrets LeakEPSS 0.2%CVE-2026-34171HIGHCoolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known valueEPSS 0.1%CVE-2026-27882MEDIUMCoolify: Timing Attack in GitLab Webhook Token ValidationEPSS 0.1%CVE-2026-34198MEDIUMCoolify: Password reset link poisoning via X-Forwarded-Host header spoofingEPSS 0.1%CVE-2026-42148LOWCoolify: Command Injection via Unescaped Version String in Docker BuildEPSS 0.1%