Where
-Infinity
0

Trending

Last week
Last month
Last year

CoolifyCoolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

Risk 23
Severity
3.3
First published (updated )
CVE-2026-42201

CoolifyCoolify: Command injection via single-quote breakout in Docker Compose custom commands

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34158

CoolifyCoolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

Risk 22
Severity
4.3
First published (updated )
CVE-2026-34170

CoolifyCross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()

Risk 78
Severity
9.9
First published (updated )
CVE-2026-34037

CoolifyCoolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34057
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

CoolifyCoolify: SSRF via S3 Storage Endpoint in testConnection()

Risk 30
Severity
4.9
First published (updated )
CVE-2026-42147

CoolifyCoolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34152

CoolifyCoolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs

Risk 23
Severity
3.3
First published (updated )
CVE-2026-34149

CoolifyCoolify: Host RCE via Sentinel token injection

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34034

CoolifyCoolify: Command injection via unsanitized persistent storage name in docker volume commands

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34168
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

CoolifyCoolify: File Upload Without Type or Size Validation in Database Backup Restore

Risk 17
Severity
3.1
First published (updated )
CVE-2026-42145

CoolifyCoolify: Password reset link poisoning via X-Forwarded-Host header spoofing

Risk 31
Severity
5.3
First published (updated )
CVE-2026-34198

CoolifyCoolify: Host RCE via Log Drain secret/env command injection

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34035

CoolifyCoolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access

Risk 17
Severity
3.1
First published (updated )
CVE-2026-42172

CoolifyCoolify: Command Injection via Unescaped Version String in Docker Build

Risk 28
Severity
3.8
First published (updated )
CVE-2026-42148
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

CoolifyCoolify unauthenticated feedback endpoint allows Discord webhook abuse

Risk 40
Severity
6.5
First published (updated )
CVE-2026-41899

CoolifyCoolify: Authenticated RCE via command injection in CA certificate management feature

Risk 79
Severity
8.8
First published (updated )
CVE-2026-27957

CoolifyCoolify: Command Injection via Single-Quote Breakout in `executeInDocker()`

Risk 44
Severity
6.6
First published (updated )
CVE-2026-27955

CoolifyCoolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)

Risk 26
Severity
5
First published (updated )
CVE-2026-27881

CoolifyCoolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure

Risk 44
Severity
7.7
First published (updated )
CVE-2026-34592
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

CoolifyCoolify: Authenticated Host RCE

Risk 79
Severity
8.8
First published (updated )
CVE-2026-34597

Coollabs CoolifyCoolify has a Privilege Escalation - low privileged users can see and use admin invitation links

Risk 79
Severity
8.8
First published (updated )
CVE-2025-64423

Coollabs CoolifyCoolify has a privilege escalation - low privileged user can invite themselves as an admin user

Risk 79
Severity
8.7
First published (updated )
CVE-2025-64421

Coollabs CoolifyCoolify has Docker Compose Injection issue

Risk 81
Severity
9.4
First published (updated )
CVE-2025-59156

Coollabs CoolifyCoolify Vulnerable to Reflected XSS on Tag Search

Risk 27
Severity
6.1
EPSS
0.04%
First published (updated )
CVE-2025-24025
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Coollabs CoolifyCoolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)

Risk 61
Severity
10
EPSS
0.04%
First published (updated )
CVE-2025-22612

Coollabs CoolifyCoolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)

Risk 59
Severity
10
EPSS
0.04%
First published (updated )
CVE-2025-22611

Coollabs CoolifyCoolify Vulnerable to OAuth Secrets Leak

Risk 27
Severity
6.5
EPSS
0.04%
First published (updated )
CVE-2025-22610

Coollabs CoolifyCoolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)

Risk 61
Severity
10
EPSS
0.04%
First published (updated )
CVE-2025-22609

Coollabs CoolifyCoolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)

Risk 28
Severity
6.5
EPSS
0.04%
First published (updated )
CVE-2025-22608
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203