Vulnerabilidades en coollabsio
76 resultadosCVE-2026-34149LOWCoolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup JobsEPSS 0.3%CVE-2026-27881MEDIUMCoolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)EPSS 0.3%CVE-2026-27955MEDIUMCoolify: Command Injection via Single-Quote Breakout in `executeInDocker()`EPSS 0.3%CVE-2026-27883MEDIUMCoolify: IDOR in Deployment API - Cross-Team Deployment Information DisclosureEPSS 0.3%CVE-2026-32718MEDIUMCoolify read-scoped API tokens can perform state-changing validation operationsEPSS 0.3%CVE-2026-34167MEDIUMCoolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitorEPSS 0.3%CVE-2026-34049LOWCoolify: Command Injection via unsanitized MongoDB collection names in database backupEPSS 0.2%CVE-2026-42201LOWCoolify: OS Command Injection via Database Credential Fields in Docker Compose Service CommandsEPSS 0.2%CVE-2025-24025LOWCoolify Vulnerable to Reflected XSS on Tag SearchEPSS 0.2%CVE-2026-42172LOWCoolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent AccessEPSS 0.2%CVE-2026-27882MEDIUMCoolify: Timing Attack in GitLab Webhook Token ValidationEPSS 0.2%CVE-2026-34170MEDIUMCoolify: Server-Side Request Forgery via attacker-controlled GitHub App API URLEPSS 0.2%CVE-2026-34171HIGHCoolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known valueEPSS 0.2%CVE-2026-42148LOWCoolify: Command Injection via Unescaped Version String in Docker BuildEPSS 0.2%CVE-2026-34198MEDIUMCoolify: Password reset link poisoning via X-Forwarded-Host header spoofingEPSS 0.2%CVE-2025-22607MEDIUMCoolify Vulnerable to GitHub / GitLab OAuth Secrets LeakEPSS 0.2%