Vulnerabilidades em coollabsio
76 resultadosAnálise Vexday
A Coollabs acumula 71 vulnerabilidades no histórico, com 46 publicadas nos últimos 90 dias, indicando ritmo acelerado de descobertas. Embora nenhuma esteja sob exploração ativa no momento, 19 são classificadas como críticas, predominantemente relacionadas a injeção de comandos (CWE-78), o que representa risco significativo se explorado. A concentração recente de divulgações requer monitoramento atento e priorização de patches críticos.
CVE-2025-64425HIGHCoolify has host header injection in forgot passwordEPSS 0.4%CVE-2026-34044HIGHCoolify: Cross-team IDOR in logs component (resource lookup not team-scoped)EPSS 0.4%CVE-2025-22610MEDIUMCoolify Vulnerable to OAuth Secrets LeakEPSS 0.4%CVE-2026-42145LOWCoolify: File Upload Without Type or Size Validation in Database Backup RestoreEPSS 0.4%CVE-2026-34050MEDIUMCoolify Settings/Updates Livewire component missing instance administrator authorizationEPSS 0.4%CVE-2025-22608MEDIUMCoolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)EPSS 0.4%CVE-2026-34037CRITICALCross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()EPSS 0.4%CVE-2026-41899MEDIUMCoolify unauthenticated feedback endpoint allows Discord webhook abuseEPSS 0.4%CVE-2026-15507MEDIUMcoollabsio Coolify Policy Policies authorizationEPSS 0.3%CVE-2025-64423HIGHCoolify has a Privilege Escalation - low privileged users can see and use admin invitation linksEPSS 0.3%CVE-2026-34592HIGHCoolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and InfrastructureEPSS 0.3%CVE-2026-42147MEDIUMCoolify: SSRF via S3 Storage Endpoint in testConnection()EPSS 0.3%CVE-2026-57498CRITICALCoolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' ServersEPSS 0.3%CVE-2025-64422MEDIUMRate-limit bypass on login via X-Forwarded-Host headerEPSS 0.3%CVE-2025-59955MEDIUMCoolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpointEPSS 0.3%CVE-2025-64421HIGHCoolify has a privilege escalation - low privileged user can invite themselves as an admin userEPSS 0.3%CVE-2026-27956MEDIUMCoolify: Cross-team application domain enumeration via domains_by_server endpointEPSS 0.3%CVE-2025-22606HIGHCoolify Command Injection Vulnerability in Project NameEPSS 0.3%CVE-2026-41896HIGHCoolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null SecretEPSS 0.3%CVE-2026-121587MEDIUMCoolify before 4.1.1 Application Name Enumeration via Manual Webhook EndpointsEPSS 0.3%