coollabsio

Records79All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical23CVSS 9.0–10.0

CVSS high27CVSS 7.0–8.9

Exploited now

coollabsio records in CISA KEV

No coollabsio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Coolify 28 records HIGH

Records

28 records in Coolify · all components

TI-2025-40716 CVE-2025-66213

Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path

HIGH 82

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.03281 Published 2025-12-23 Fixed in 4.0.0-beta.451 CWE-78

TI-2025-40715 CVE-2025-66212

Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename

HIGH 82

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.03254 Published 2025-12-23 Fixed in 4.0.0-beta.451 CWE-78

TI-2025-40714 CVE-2025-66211

Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename

HIGH 82

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.02854 Published 2025-12-23 Fixed in 4.0.0-beta.451 CWE-78

TI-2025-40713 CVE-2025-66210

Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import

HIGH 82

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.02854 Published 2025-12-23 Fixed in 4.0.0-beta.451 CWE-78

TI-2025-40712 CVE-2025-66209

Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup

HIGH 82

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.03875 Published 2025-12-23 Fixed in 4.0.0-beta.451 CWE-78

TI-2025-16498 CVE-2025-22612

Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)

HIGH 82

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00616 Published 2025-01-24 Fixed in 4.0.0-beta.374 CWE-200

TI-2025-16495 CVE-2025-22609

Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)

HIGH 82

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00746 Published 2025-01-24 Fixed in 4.0.0-beta.361 CWE-862

TI-2025-39838 CVE-2025-64424

Colify has command injection vulnerability in project git source

HIGH 76

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.02064 Published 2026-01-05 No fix listed CWE-77

TI-2025-39833 CVE-2025-64419

Coolify vulnerable to command injection via docker-compose.yaml parameters

HIGH 76

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00651 Published 2026-01-05 Fixed in 4.0.0-beta.445 CWE-77

TI-2025-36762 CVE-2025-59158

Coolify has Stored XSS in Project Name

HIGH 76

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0CRITICAL 9.4 Network Low privileges User interaction EPSS 0.00499 Published 2026-01-05 Fixed in 4.0.0-beta.420.7 CWE-116

TI-2025-36761 CVE-2025-59157

Coolify has Git Repository RCE

HIGH 76

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01822 Published 2026-01-05 Fixed in 4.0.0-beta.420.7 CWE-78

TI-2025-36760 CVE-2025-59156

Coolify has Docker Compose Injection issue

HIGH 76

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00998 Published 2026-01-05 Fixed in 4.0.0-beta.420.7 CWE-78

TI-2025-39839 CVE-2025-64425

Coolify has host header injection in forgot password

HIGH 72

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00425 Published 2026-01-05 No fix listed CWE-644

TI-2025-16492 CVE-2025-22606

Coolify Command Injection Vulnerability in Project Name

HIGH 72

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00286 Published 2025-01-24 Fixed in 4.0.0-beta.359 CWE-78

TI-2025-16491 CVE-2025-22605

Coolify OS Command Injection Vulnerability in SSH Command Generation

HIGH 72

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00517 Published 2025-01-24 Fixed in 4.0.0-beta.253 CWE-78

TI-2025-39837 CVE-2025-64423

Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links

HIGH 69

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00347 Published 2026-01-05 No fix listed CWE-287

TI-2025-16494 CVE-2025-22608

Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)

HIGH 68

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00376 Published 2025-01-24 Fixed in 4.0.0-beta.361 CWE-639

TI-2025-37343 CVE-2025-59955

Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint

MEDIUM 59

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00303 Published 2026-01-05 No fix listed CWE-201

TI-2025-16493 CVE-2025-22607

Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak

MEDIUM 55

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00165 Published 2025-01-24 Fixed in 4.0.0-beta.361 CWE-200

TI-2025-24315 CVE-2025-34161 · GHSA-xp99-74mm-rpv2

Coolify Git Repository Field Command Injection in Project Deployment Workflow

MEDIUM 48

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.02963 Published 2025-08-27 Fixed in 4.0.0-beta.420.7 CWE-20

TI-2025-24313 CVE-2025-34159 · GHSA-qh8c-f279-4cgv

Coolify Docker Compose Directive Injection in Application Deployment Workflow

MEDIUM 44

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00971 Published 2025-08-27 Fixed in 4.0.0-beta.420.7 CWE-20

TI-2025-39834 CVE-2025-64420

Coolify members can see private key of root user

MEDIUM 43

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00525 Published 2026-01-05 No fix listed CWE-522

TI-2025-24311 CVE-2025-34157 · GHSA-6p37-qg9q-mprw

Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

MEDIUM 43

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow.

CVSS 4.0CRITICAL 9.4 Network Low privileges User interaction EPSS 0.00481 Published 2025-08-27 Fixed in 4.0.0.-beta.420.7 CWE-20

TI-2025-16497 CVE-2025-22611

Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)

MEDIUM 43

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00488 Published 2025-01-24 Fixed in 4.0.0-beta.361 CWE-862

TI-2025-39835 CVE-2025-64421

Coolify has a privilege escalation - low privileged user can invite themselves as an admin user

LOW 39

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00302 Published 2026-01-05 No fix listed CWE-863

Open these records in search →