coollabsio
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 5
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, coollabsio recorded 5 security vulnerabilities in the last 90 days across 1 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, coolify had the most security vulnerabilities in the coollabsio ecosystem, with 5 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-12815coollabsio coolify Image Name os command injectionCVE-2025-64425Coolify has host header injection in forgot passwordCVE-2025-64424Colify has command injection vulnerability in project git sourceCVE-2025-64423Coolify has a Privilege Escalation - low privileged users can see and use admin invitation linksCVE-2025-64422Rate-limit bypass on login via X-Forwarded-Host header| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-12815coollabsio coolify Image Name os command injection | Exploitation statusActively exploited | FixNo |
| Published06/21/2026 |
| SeverityMedium |
CVE-2025-64425Coolify has host header injection in forgot password | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-64424Colify has command injection vulnerability in project git source | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-64423Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-64422Rate-limit bypass on login via X-Forwarded-Host header | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-64421Coolify has a privilege escalation - low privileged user can invite themselves as an admin user | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-64420Coolify members can see private key of root user | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-64419Coolify vulnerable to command injection via docker-compose.yaml parameters | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-59955Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-59158Coolify has Stored XSS in Project Name | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-59157Coolify has Git Repository RCE | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-59156Coolify has Docker Compose Injection issue | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-66213Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-66212Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-66211Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-66210Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-66209Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-24025Coolify Vulnerable to Reflected XSS on Tag Search | Exploitation statusNot exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityLow |
|---|
CVE-2025-22612Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityCritical |
|---|
CVE-2025-22611Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE) | Exploitation statusNot exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityCritical |
|---|
CVE-2025-22610Coolify Vulnerable to OAuth Secrets Leak | Exploitation statusNot exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityMedium |
|---|
CVE-2025-22609Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityCritical |
|---|
CVE-2025-22608Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityMedium |
|---|
CVE-2025-22607Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityMedium |
|---|
CVE-2025-22606Coolify Command Injection Vulnerability in Project Name | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityHigh |
|---|
CVE-2025-22605Coolify OS Command Injection Vulnerability in SSH Command Generation | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published01/24/2025 | SeverityHigh |
|---|
76 Results | Page 2 of 2