Where
-Infinity
0

Trending

Last week
Last month
Last year

Coolify CoolifyCoolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

Risk 79
Severity
8.8
First published (updated )
CVE-2026-59734

Coolify CoolifyCoolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers

Risk 82
Severity
9.9
First published (updated )
CVE-2026-34048

Coolify CoolifyCoolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers

Risk 79
Severity
8.8
First published (updated )
CVE-2026-42143

Coolify CoolifyCoolify: Cross-team IDOR in logs component (resource lookup not team-scoped)

Risk 44
Severity
7.7
First published (updated )
CVE-2026-34044

Coolify CoolifyCoolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value

Risk 58
Severity
8
First published (updated )
CVE-2026-34171
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Coolify CoolifyCoolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34058

Coolify CoolifyCoolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution

Risk 82
Severity
9.9
First published (updated )
CVE-2026-34047

Coolify CoolifyCoolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE

Risk 79
Severity
8.8
First published (updated )
CVE-2026-42200

Coolify CoolifyCoolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

Risk 79
Severity
8.8
First published (updated )
CVE-2026-42153

Coolify CoolifyCoolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor

Risk 26
Severity
5
First published (updated )
CVE-2026-34167
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Coolify CoolifyCoolify: Command Injection via unsanitized MongoDB collection names in database backup

Risk 23
Severity
3.3
First published (updated )
CVE-2026-34049

Coolify CoolifyCoolify: Authenticated Remote Code Execution in GetLogs Livewire Component

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34599

Coolify CoolifyCoolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

Risk 79
Severity
8.8
First published (updated )
CVE-2026-42204

Coolify CoolifyCoolify LocalFileVolume fs_path command injection enables RCE

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34153

Coolify CoolifyCoolify Settings/Updates Livewire component missing instance administrator authorization

Risk 38
Severity
6.5
First published (updated )
CVE-2026-34050
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Coolify CoolifyCoolify read-scoped API tokens can perform state-changing validation operations

Risk 38
Severity
6.5
First published (updated )
CVE-2026-32718

Coolify CoolifyCoolify authenticated remote command injection leading to RCE and secret exfiltration

Risk 82
Severity
9.9
First published (updated )
CVE-2026-34038

Coolify CoolifyCoolify: Cross-team application domain enumeration via domains_by_server endpoint

Risk 22
Severity
4.3
First published (updated )
CVE-2026-27956

Coolify CoolifyCoolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure

Risk 26
Severity
5
First published (updated )
CVE-2026-27883

Coolify CoolifyCoolify: Timing Attack in GitLab Webhook Token Validation

Risk 32
Severity
4.8
First published (updated )
CVE-2026-27882
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Coolify CoolifyCoolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34594

Coolify CoolifyCoolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret

Risk 43
Severity
7.5
First published (updated )
CVE-2026-41896

Coolify CoolifyCoolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers

Risk 68
Severity
9.6
First published (updated )
CVE-2026-57498

Coollabs CoolifyCoolify Stored Cross-Site Scripting (XSS) in Project Name Field

Risk 77
Severity
9.4
First published (updated )
CVE-2025-34157

Coollabs CoolifyCoolify Docker Compose Directive Injection in Application Deployment Workflow

Risk 81
Severity
9.4
First published (updated )
CVE-2025-34159
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Coollabs CoolifyCoolify Git Repository Field Command Injection in Project Deployment Workflow

Risk 81
Severity
9.4
First published (updated )
CVE-2025-34161

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203