CVEs we hold for Coollabsio

Records whose assigning authority named Coollabsio as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-86117Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matchingcoollabsio coolify

CVE-2026-84694Coolify before 4.2.0 Remote Code Execution via Environment Variable Keycoollabsio coolify

CVE-2026-59734Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Executioncoollabsio coolify

CVE-2026-57498Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams'…coollabsio coolify

CVE-2026-42204Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host rootcoollabsio coolify

CVE-2026-42201Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commandscoollabsio coolify

CVE-2026-42200Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCEcoollabsio coolify

CVE-2026-42172Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Accesscoollabsio coolify

CVE-2026-42153Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Containercoollabsio coolify

CVE-2026-42148Coolify: Command Injection via Unescaped Version String in Docker Buildcoollabsio coolify

CVE-2026-42147Coolify: SSRF via S3 Storage Endpoint in testConnection()coollabsio coolify

CVE-2026-42145Coolify: File Upload Without Type or Size Validation in Database Backup Restorecoollabsio coolify

CVE-2026-42143Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Serverscoollabsio coolify

CVE-2026-41899Coolify unauthenticated feedback endpoint allows Discord webhook abusecoollabsio coolify

CVE-2026-41896Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secretcoollabsio coolify

CVE-2026-34599Coolify: Authenticated Remote Code Execution in GetLogs Livewire Componentcoollabsio coolify

CVE-2026-34597Coolify: Authenticated Host RCEcoollabsio coolify

CVE-2026-34594Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Managementcoollabsio coolify

CVE-2026-34592Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructurecoollabsio coolify

CVE-2026-34198Coolify: Password reset link poisoning via X-Forwarded-Host header spoofingcoollabsio coolify

CVE-2026-34171Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known valuecoollabsio coolify

CVE-2026-34170Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URLcoollabsio coolify

CVE-2026-34168Coolify: Command injection via unsanitized persistent storage name in docker volume commandscoollabsio coolify

CVE-2026-34167Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitorcoollabsio coolify

CVE-2026-34158Coolify: Command injection via single-quote breakout in Docker Compose custom commandscoollabsio coolify

CVE-2026-34153Coolify LocalFileVolume fs_path command injection enables RCEcoollabsio coolify

CVE-2026-34152Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)coollabsio coolify

CVE-2026-34149Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobscoollabsio coolify

CVE-2026-34058Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Executioncoollabsio coolify

CVE-2026-34057Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Namecoollabsio coolify

CVE-2026-34050Coolify Settings/Updates Livewire component missing instance administrator authorizationcoollabsio coolify

CVE-2026-34049Coolify: Command Injection via unsanitized MongoDB collection names in database backupcoollabsio coolify

CVE-2026-34048Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands…coollabsio coolify

CVE-2026-34047Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Executioncoollabsio coolify

CVE-2026-34044Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)coollabsio coolify

CVE-2026-34038Coolify authenticated remote command injection leading to RCE and secret exfiltrationcoollabsio coolify

CVE-2026-34037Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()coollabsio coolify

CVE-2026-34035Coolify: Host RCE via Log Drain secret/env command injectioncoollabsio coolify

CVE-2026-34034Coolify: Host RCE via Sentinel token injectioncoollabsio coolify

CVE-2026-32718Coolify read-scoped API tokens can perform state-changing validation operationscoollabsio coolify

CVE-2026-27957Coolify: Authenticated RCE via command injection in CA certificate management featurecoollabsio coolify

CVE-2026-27956Coolify: Cross-team application domain enumeration via domains_by_server endpointcoollabsio coolify

CVE-2026-27955Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`coollabsio coolify

CVE-2026-27883Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosurecoollabsio coolify

CVE-2026-27882Coolify: Timing Attack in GitLab Webhook Token Validationcoollabsio coolify

CVE-2026-27881Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)coollabsio coolify

CVE-2026-15507coollabsio Coolify Policy Policies authorizationcoollabsio Coolify

CVE-2026-12815coollabsio coolify Image Name os command injectioncoollabsio coolify

CVE-2025-66213Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Pathcoollabsio coolify

CVE-2025-66212Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filenamecoollabsio coolify

CVE-2025-66211Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filenamecoollabsio coolify

CVE-2025-66210Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Importcoollabsio coolify

CVE-2025-66209Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backupcoollabsio coolify

CVE-2025-64425Coolify has host header injection in forgot passwordcoollabsio coolify

CVE-2025-64424Colify has command injection vulnerability in project git sourcecoollabsio coolify

CVE-2025-64423Coolify has a Privilege Escalation - low privileged users can see and use admin invitation linkscoollabsio coolify

CVE-2025-64422Rate-limit bypass on login via X-Forwarded-Host headercoollabsio coolify

CVE-2025-64421Coolify has a privilege escalation - low privileged user can invite themselves as an admin usercoollabsio coolify

CVE-2025-64420Coolify members can see private key of root usercoollabsio coolify

CVE-2025-64419Coolify vulnerable to command injection via docker-compose.yaml parameterscoollabsio coolify

CVE-2025-59955Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpointcoollabsio coolify

CVE-2025-59158Coolify has Stored XSS in Project Namecoollabsio coolify

CVE-2025-59157Coolify has Git Repository RCEcoollabsio coolify

CVE-2025-59156Coolify has Docker Compose Injection issuecoollabsio coolify

CVE-2025-24025Coolify Vulnerable to Reflected XSS on Tag Searchcoollabsio coolify

CVE-2025-22612Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)coollabsio coolify

CVE-2025-22611Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)coollabsio coolify

CVE-2025-22610Coolify Vulnerable to OAuth Secrets Leakcoollabsio coolify

CVE-2025-22609Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)coollabsio coolify

CVE-2025-22608Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)coollabsio coolify

CVE-2025-22607Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leakcoollabsio coolify

CVE-2025-22606Coolify Command Injection Vulnerability in Project Namecoollabsio coolify

CVE-2025-22605Coolify OS Command Injection Vulnerability in SSH Command Generationcoollabsio coolify

73 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.