目標達成 すべての支援者に感謝 — 100%達成しました!

目標: 1000 CNY · 調達済み: 1336 CNY

100%

coolify 产品漏洞列表 / CVE 中文分析 74

coolify 产品相关 74 条漏洞,AI 中文标题与摘要、CVSS、POC 一站汇总。

Coolify 是一款开源的自我托管式平台,用于简化应用部署与管理流程,本页面聚焦于该产品的各类安全漏洞信息。聚合内容涵盖了导致远程代码执行、权限提升及数据泄露等关键风险,时间范围涵盖自产品公开以来至今的已知缺陷记录。通过浏览此页面,安全研究人员与企业运维人员可以高效追踪官方发布的最新安全补丁,深入理解底层架构中存在的配置弱点,或基于关键词检索特定版本的历史漏洞详情,从而及时评估并修复潜在威胁以保障服务稳定性。

ベンダー: coollabsio

CVE IDタイトルCVSS深刻度公開日
CVE-2026-41899 Coolify unauthenticated feedback endpoint allows Discord webhook abuse CWE-306 6.5 Medium2026-07-06
CVE-2026-34050 Coolify Settings/Updates Livewire component missing instance administrator authorization CWE-862 6.5 Medium2026-07-06
CVE-2026-32718 Coolify read-scoped API tokens can perform state-changing validation operations CWE-863 6.5 Medium2026-07-06
CVE-2026-34038 Coolify authenticated remote command injection leading to RCE and secret exfiltration CWE-78 9.9 Critical2026-07-06
CVE-2026-27957 Coolify: Authenticated RCE via command injection in CA certificate management feature CWE-78 8.8 High2026-06-30
CVE-2026-27956 Coolify: Cross-team application domain enumeration via domains_by_server endpoint CWE-639 4.3 Medium2026-06-30
CVE-2026-27955 Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()` CWE-78 6.6 Medium2026-06-30
CVE-2026-27883 Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure CWE-639 5.0 Medium2026-06-30
CVE-2026-27881 Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) CWE-639 5.0 Medium2026-06-30
CVE-2026-27882 Coolify: Timing Attack in GitLab Webhook Token Validation CWE-208 4.8 Medium2026-06-30
CVE-2026-34592 Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure CWE-639 7.7 High2026-06-29
CVE-2026-34594 Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management CWE-78 8.8 High2026-06-29
CVE-2026-34597 Coolify: Authenticated Host RCE CWE-78 8.8 High2026-06-29
CVE-2026-41896 Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret CWE-287 7.5 High2026-06-29
CVE-2026-57498 Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers CWE-639 9.6 Critical2026-06-29
CVE-2026-12815 coollabsio coolify Image Name os command injection CWE-78 6.3 Medium2026-06-21
CVE-2025-64425 Coolify has host header injection in forgot password CWE-644 8.0 -2026-01-05
CVE-2025-64424 Colify has command injection vulnerability in project git source CWE-77 8.8 -2026-01-05
CVE-2025-64423 Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links CWE-287 8.0 -2026-01-05
CVE-2025-64422 Rate-limit bypass on login via X-Forwarded-Host header CWE-770 9.8 -2026-01-05
CVE-2025-64421 Coolify has a privilege escalation - low privileged user can invite themselves as an admin user CWE-863 8.8 -2026-01-05
CVE-2025-64420 Coolify members can see private key of root user CWE-522 10.0 Critical2026-01-05
CVE-2025-64419 Coolify vulnerable to command injection via docker-compose.yaml parameters CWE-77 9.7 Critical2026-01-05
CVE-2025-59955 Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint CWE-201 7.1 -2026-01-05
CVE-2025-59158 Coolify has Stored XSS in Project Name CWE-116 5.4 -2026-01-05
CVE-2025-59157 Coolify has Git Repository RCE CWE-78 10.0 Critical2026-01-05
CVE-2025-59156 Coolify has Docker Compose Injection issue CWE-78 9.9 -2026-01-05
CVE-2025-66213 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path CWE-78 9.9AICriticalAI2025-12-23
CVE-2025-66212 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename CWE-78 8.8AIHighAI2025-12-23
CVE-2025-66211 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename CWE-78 8.8AIHighAI2025-12-23

coolify 产品累计公开 74 条 CVE 漏洞,本页提供按时间倒序的完整列表,包含 CVSS、CWE、AI 中文摘要与可获取的 POC 链接。