agentprime: coollabsio-coolifyEvery new CVE for coollabsio-coolify.https://agentprime.io/CVE-2026-121587: Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpointshttps://agentprime.io/advisories/CVE-2026-121587/https://agentprime.io/advisories/CVE-2026-121587/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 16:26:52 GMTCVECVE-2026-100746: coollabsio Coolify GitHub App Setup redirect missing authenticationhttps://agentprime.io/advisories/CVE-2026-100746/https://agentprime.io/advisories/CVE-2026-100746/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 27 Sep 2026 03:30:18 GMTCVECVE-2026-100744: coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorizationhttps://agentprime.io/advisories/CVE-2026-100744/https://agentprime.io/advisories/CVE-2026-100744/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 27 Sep 2026 01:15:13 GMTCVECVE-2026-86117: Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matchinghttps://agentprime.io/advisories/CVE-2026-86117/https://agentprime.io/advisories/CVE-2026-86117/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 09:59:07 GMTCVEcriticalCVE-2026-84694: Coolify before 4.2.0 Remote Code Execution via Environment Variable Keyhttps://agentprime.io/advisories/CVE-2026-84694/https://agentprime.io/advisories/CVE-2026-84694/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 00:37:50 GMTCVECVE-2026-15507: coollabsio Coolify Policy Policies authorizationhttps://agentprime.io/advisories/CVE-2026-15507/https://agentprime.io/advisories/CVE-2026-15507/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 12 Jul 2026 22:00:11 GMTCVECVE-2026-59734: Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-59734/https://agentprime.io/advisories/CVE-2026-59734/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 17:35:05 GMTCVECVE-2026-42201: Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commandshttps://agentprime.io/advisories/CVE-2026-42201/https://agentprime.io/advisories/CVE-2026-42201/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:29:13 GMTCVECVE-2026-34158: Coolify: Command injection via single-quote breakout in Docker Compose custom commandshttps://agentprime.io/advisories/CVE-2026-34158/https://agentprime.io/advisories/CVE-2026-34158/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:28:33 GMTCVECVE-2026-34170: Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URLhttps://agentprime.io/advisories/CVE-2026-34170/https://agentprime.io/advisories/CVE-2026-34170/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:23:40 GMTCVECVE-2026-34037: Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()https://agentprime.io/advisories/CVE-2026-34037/https://agentprime.io/advisories/CVE-2026-34037/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:21:52 GMTCVEcriticalCVE-2026-34048: Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servershttps://agentprime.io/advisories/CVE-2026-34048/https://agentprime.io/advisories/CVE-2026-34048/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:19:42 GMTCVEcriticalCVE-2026-34057: Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Namehttps://agentprime.io/advisories/CVE-2026-34057/https://agentprime.io/advisories/CVE-2026-34057/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:17:37 GMTCVECVE-2026-42143: Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servershttps://agentprime.io/advisories/CVE-2026-42143/https://agentprime.io/advisories/CVE-2026-42143/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:15:04 GMTCVECVE-2026-42147: Coolify: SSRF via S3 Storage Endpoint in testConnection()https://agentprime.io/advisories/CVE-2026-42147/https://agentprime.io/advisories/CVE-2026-42147/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:13:50 GMTCVECVE-2026-34044: Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)https://agentprime.io/advisories/CVE-2026-34044/https://agentprime.io/advisories/CVE-2026-34044/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:12:30 GMTCVECVE-2026-34152: Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)https://agentprime.io/advisories/CVE-2026-34152/https://agentprime.io/advisories/CVE-2026-34152/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:11:14 GMTCVECVE-2026-34149: Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobshttps://agentprime.io/advisories/CVE-2026-34149/https://agentprime.io/advisories/CVE-2026-34149/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:09:33 GMTCVECVE-2026-34171: Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known valuehttps://agentprime.io/advisories/CVE-2026-34171/https://agentprime.io/advisories/CVE-2026-34171/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:07:50 GMTCVECVE-2026-34034: Coolify: Host RCE via Sentinel token injectionhttps://agentprime.io/advisories/CVE-2026-34034/https://agentprime.io/advisories/CVE-2026-34034/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:06:31 GMTCVECVE-2026-34168: Coolify: Command injection via unsanitized persistent storage name in docker volume commandshttps://agentprime.io/advisories/CVE-2026-34168/https://agentprime.io/advisories/CVE-2026-34168/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:05:18 GMTCVECVE-2026-42145: Coolify: File Upload Without Type or Size Validation in Database Backup Restorehttps://agentprime.io/advisories/CVE-2026-42145/https://agentprime.io/advisories/CVE-2026-42145/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:03:58 GMTCVECVE-2026-34198: Coolify: Password reset link poisoning via X-Forwarded-Host header spoofinghttps://agentprime.io/advisories/CVE-2026-34198/https://agentprime.io/advisories/CVE-2026-34198/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 03:01:19 GMTCVECVE-2026-34058: Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-34058/https://agentprime.io/advisories/CVE-2026-34058/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 02:58:57 GMTCVECVE-2026-34035: Coolify: Host RCE via Log Drain secret/env command injectionhttps://agentprime.io/advisories/CVE-2026-34035/https://agentprime.io/advisories/CVE-2026-34035/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 02:56:44 GMTCVECVE-2026-34047: Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-34047/https://agentprime.io/advisories/CVE-2026-34047/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 02:54:59 GMTCVEcriticalCVE-2026-42172: Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Accesshttps://agentprime.io/advisories/CVE-2026-42172/https://agentprime.io/advisories/CVE-2026-42172/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 02:52:58 GMTCVECVE-2026-42200: Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCEhttps://agentprime.io/advisories/CVE-2026-42200/https://agentprime.io/advisories/CVE-2026-42200/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 02:48:04 GMTCVECVE-2026-42153: Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Containerhttps://agentprime.io/advisories/CVE-2026-42153/https://agentprime.io/advisories/CVE-2026-42153/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:30:44 GMTCVECVE-2026-34167: Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitorhttps://agentprime.io/advisories/CVE-2026-34167/https://agentprime.io/advisories/CVE-2026-34167/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:28:24 GMTCVECVE-2026-34049: Coolify: Command Injection via unsanitized MongoDB collection names in database backuphttps://agentprime.io/advisories/CVE-2026-34049/https://agentprime.io/advisories/CVE-2026-34049/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:22:46 GMTCVECVE-2026-34599: Coolify: Authenticated Remote Code Execution in GetLogs Livewire Componenthttps://agentprime.io/advisories/CVE-2026-34599/https://agentprime.io/advisories/CVE-2026-34599/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:20:56 GMTCVECVE-2026-42204: Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host roothttps://agentprime.io/advisories/CVE-2026-42204/https://agentprime.io/advisories/CVE-2026-42204/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:17:16 GMTCVECVE-2026-42148: Coolify: Command Injection via Unescaped Version String in Docker Buildhttps://agentprime.io/advisories/CVE-2026-42148/https://agentprime.io/advisories/CVE-2026-42148/CVSS 3.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:14:31 GMTCVECVE-2026-34153: Coolify LocalFileVolume fs_path command injection enables RCEhttps://agentprime.io/advisories/CVE-2026-34153/https://agentprime.io/advisories/CVE-2026-34153/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:12:46 GMTCVECVE-2026-41899: Coolify unauthenticated feedback endpoint allows Discord webhook abusehttps://agentprime.io/advisories/CVE-2026-41899/https://agentprime.io/advisories/CVE-2026-41899/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:10:40 GMTCVECVE-2026-34050: Coolify Settings/Updates Livewire component missing instance administrator authorizationhttps://agentprime.io/advisories/CVE-2026-34050/https://agentprime.io/advisories/CVE-2026-34050/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:08:08 GMTCVECVE-2026-32718: Coolify read-scoped API tokens can perform state-changing validation operationshttps://agentprime.io/advisories/CVE-2026-32718/https://agentprime.io/advisories/CVE-2026-32718/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:04:59 GMTCVECVE-2026-34038: Coolify authenticated remote command injection leading to RCE and secret exfiltrationhttps://agentprime.io/advisories/CVE-2026-34038/https://agentprime.io/advisories/CVE-2026-34038/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 20:48:23 GMTCVEcriticalCVE-2026-27957: Coolify: Authenticated RCE via command injection in CA certificate management featurehttps://agentprime.io/advisories/CVE-2026-27957/https://agentprime.io/advisories/CVE-2026-27957/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 14:39:06 GMTCVECVE-2026-27956: Coolify: Cross-team application domain enumeration via domains_by_server endpointhttps://agentprime.io/advisories/CVE-2026-27956/https://agentprime.io/advisories/CVE-2026-27956/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 14:38:15 GMTCVECVE-2026-27955: Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`https://agentprime.io/advisories/CVE-2026-27955/https://agentprime.io/advisories/CVE-2026-27955/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 14:36:41 GMTCVECVE-2026-27883: Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosurehttps://agentprime.io/advisories/CVE-2026-27883/https://agentprime.io/advisories/CVE-2026-27883/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 14:32:25 GMTCVECVE-2026-27881: Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)https://agentprime.io/advisories/CVE-2026-27881/https://agentprime.io/advisories/CVE-2026-27881/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 14:28:38 GMTCVECVE-2026-27882: Coolify: Timing Attack in GitLab Webhook Token Validationhttps://agentprime.io/advisories/CVE-2026-27882/https://agentprime.io/advisories/CVE-2026-27882/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 14:26:44 GMTCVECVE-2026-34592: Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructurehttps://agentprime.io/advisories/CVE-2026-34592/https://agentprime.io/advisories/CVE-2026-34592/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 29 Jun 2026 21:47:23 GMTCVECVE-2026-34594: Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Managementhttps://agentprime.io/advisories/CVE-2026-34594/https://agentprime.io/advisories/CVE-2026-34594/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 29 Jun 2026 20:21:59 GMTCVECVE-2026-34597: Coolify: Authenticated Host RCEhttps://agentprime.io/advisories/CVE-2026-34597/https://agentprime.io/advisories/CVE-2026-34597/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 29 Jun 2026 20:18:37 GMTCVECVE-2026-41896: Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secrethttps://agentprime.io/advisories/CVE-2026-41896/https://agentprime.io/advisories/CVE-2026-41896/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 29 Jun 2026 20:16:50 GMTCVECVE-2026-57498: Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servershttps://agentprime.io/advisories/CVE-2026-57498/https://agentprime.io/advisories/CVE-2026-57498/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 29 Jun 2026 20:12:07 GMTCVEcritical