Vulnerabilidades em coollabsio

76 resultados
Análise Vexday

A Coollabs acumula 71 vulnerabilidades no histórico, com 46 publicadas nos últimos 90 dias, indicando ritmo acelerado de descobertas. Embora nenhuma esteja sob exploração ativa no momento, 19 são classificadas como críticas, predominantemente relacionadas a injeção de comandos (CWE-78), o que representa risco significativo se explorado. A concentração recente de divulgações requer monitoramento atento e priorização de patches críticos.

CVE-2026-34149LOWCoolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup JobsEPSS 0.3%CVE-2026-27881MEDIUMCoolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)EPSS 0.3%CVE-2026-27955MEDIUMCoolify: Command Injection via Single-Quote Breakout in `executeInDocker()`EPSS 0.3%CVE-2026-27883MEDIUMCoolify: IDOR in Deployment API - Cross-Team Deployment Information DisclosureEPSS 0.3%CVE-2026-32718MEDIUMCoolify read-scoped API tokens can perform state-changing validation operationsEPSS 0.3%CVE-2026-34167MEDIUMCoolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitorEPSS 0.3%CVE-2026-34049LOWCoolify: Command Injection via unsanitized MongoDB collection names in database backupEPSS 0.2%CVE-2026-42201LOWCoolify: OS Command Injection via Database Credential Fields in Docker Compose Service CommandsEPSS 0.2%CVE-2025-24025LOWCoolify Vulnerable to Reflected XSS on Tag SearchEPSS 0.2%CVE-2026-42172LOWCoolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent AccessEPSS 0.2%CVE-2026-27882MEDIUMCoolify: Timing Attack in GitLab Webhook Token ValidationEPSS 0.2%CVE-2026-34170MEDIUMCoolify: Server-Side Request Forgery via attacker-controlled GitHub App API URLEPSS 0.2%CVE-2026-34171HIGHCoolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known valueEPSS 0.2%CVE-2026-42148LOWCoolify: Command Injection via Unescaped Version String in Docker BuildEPSS 0.2%CVE-2026-34198MEDIUMCoolify: Password reset link poisoning via X-Forwarded-Host header spoofingEPSS 0.2%CVE-2025-22607MEDIUMCoolify Vulnerable to GitHub / GitLab OAuth Secrets LeakEPSS 0.2%