coollabsio vulnerabilities

CVEs per yearBy the year they were published

1. 202514
2. 202662

Newest CVEs

• CVE-2026-121587

  Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

  coollabsio · coolify

  Medium6.9
• CVE-2026-100746

  coollabsio Coolify GitHub App Setup redirect missing authentication

  coollabsio · Coolify

  Medium6.9
• CVE-2026-100744

  coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

  coollabsio · Coolify

  Medium6.9
• CVE-2026-86117

  Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

  coollabsio · coolify

  Critical9.2
• CVE-2026-84694

  Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

  coollabsio · coolify

  High8.7
• CVE-2026-15507

  coollabsio Coolify Policy Policies authorization

  coollabsio · Coolify

  Medium5.3
• CVE-2026-59734

  Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

  coollabsio · coolify

  High8.8
• CVE-2026-42201

  Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

  coollabsio · coolify

  Low3.3
• CVE-2026-34158

  Coolify: Command injection via single-quote breakout in Docker Compose custom commands

  coollabsio · coolify

  High8.8
• CVE-2026-34170

  Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

  coollabsio · coolify

  Medium4.3