Vulnerabilidades em coollabsio
73 resultadosAnálise Vexday
A Coollabs acumula 71 vulnerabilidades no histórico, com 46 publicadas nos últimos 90 dias, indicando ritmo acelerado de descobertas. Embora nenhuma esteja sob exploração ativa no momento, 19 são classificadas como críticas, predominantemente relacionadas a injeção de comandos (CWE-78), o que representa risco significativo se explorado. A concentração recente de divulgações requer monitoramento atento e priorização de patches críticos.
CVE-2026-86117CRITICALCoolify through 4.3.17 OAuth Account Takeover via Unverified Email MatchingEPSS 0.4%CVE-2025-64425HIGHCoolify has host header injection in forgot passwordEPSS 0.4%CVE-2026-34044HIGHCoolify: Cross-team IDOR in logs component (resource lookup not team-scoped)EPSS 0.4%CVE-2026-27955MEDIUMCoolify: Command Injection via Single-Quote Breakout in `executeInDocker()`EPSS 0.4%CVE-2026-42145LOWCoolify: File Upload Without Type or Size Validation in Database Backup RestoreEPSS 0.4%CVE-2025-22610MEDIUMCoolify Vulnerable to OAuth Secrets LeakEPSS 0.4%CVE-2026-41896HIGHCoolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null SecretEPSS 0.4%CVE-2026-57498CRITICALCoolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' ServersEPSS 0.4%CVE-2026-32718MEDIUMCoolify read-scoped API tokens can perform state-changing validation operationsEPSS 0.4%CVE-2026-34050MEDIUMCoolify Settings/Updates Livewire component missing instance administrator authorizationEPSS 0.4%CVE-2026-27883MEDIUMCoolify: IDOR in Deployment API - Cross-Team Deployment Information DisclosureEPSS 0.4%CVE-2025-22608MEDIUMCoolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)EPSS 0.4%CVE-2026-34149LOWCoolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup JobsEPSS 0.4%CVE-2026-15507MEDIUMcoollabsio Coolify Policy Policies authorizationEPSS 0.3%CVE-2026-34167MEDIUMCoolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitorEPSS 0.3%CVE-2025-64423HIGHCoolify has a Privilege Escalation - low privileged users can see and use admin invitation linksEPSS 0.3%CVE-2026-34592HIGHCoolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and InfrastructureEPSS 0.3%CVE-2026-42201LOWCoolify: OS Command Injection via Database Credential Fields in Docker Compose Service CommandsEPSS 0.3%CVE-2026-34049LOWCoolify: Command Injection via unsanitized MongoDB collection names in database backupEPSS 0.3%CVE-2025-64422MEDIUMRate-limit bypass on login via X-Forwarded-Host headerEPSS 0.3%