Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

coollabsio — Vulnerabilities & Security Advisories 75

Browse all 75 CVE security advisories affecting coollabsio. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Coollabs.io operates as a comprehensive platform for managing and monetizing content creator communities, primarily through its proprietary software, All in One SEO. This infrastructure handles sensitive user data, payment processing, and extensive content management workflows, making it a significant target for automated scanning and exploitation. Historical vulnerability records indicate a prevalence of cross-site scripting (XSS) and SQL injection flaws, stemming from complex input validation requirements across its diverse modules. Additionally, the platform has faced instances of remote code execution and privilege escalation vulnerabilities, often linked to outdated dependencies or misconfigured server environments. While no catastrophic data breaches have been publicly confirmed, the accumulation of twenty-five Common Vulnerabilities and Exposures highlights ongoing challenges in maintaining rigorous security hygiene. These findings underscore the critical need for continuous patch management and secure coding practices within large-scale community management ecosystems to mitigate risks associated with high-traffic web applications.

Top products by coollabsio: coolify
CVE ID Title CVSS Severity Published
CVE-2026-34599 Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component — coolify CWE-78 8.8 High 2026-07-06
CVE-2026-42204 Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root — coolify CWE-78 8.8 High 2026-07-06
CVE-2026-42148 Coolify: Command Injection via Unescaped Version String in Docker Build — coolify CWE-78 3.8 Low 2026-07-06
CVE-2026-34153 Coolify LocalFileVolume fs_path command injection enables RCE — coolify CWE-78 8.8 High 2026-07-06
CVE-2026-41899 Coolify unauthenticated feedback endpoint allows Discord webhook abuse — coolify CWE-306 6.5 Medium 2026-07-06
CVE-2026-34050 Coolify Settings/Updates Livewire component missing instance administrator authorization — coolify CWE-862 6.5 Medium 2026-07-06
CVE-2026-32718 Coolify read-scoped API tokens can perform state-changing validation operations — coolify CWE-863 6.5 Medium 2026-07-06
CVE-2026-34038 Coolify authenticated remote command injection leading to RCE and secret exfiltration — coolify CWE-78 9.9 Critical 2026-07-06
CVE-2026-27957 Coolify: Authenticated RCE via command injection in CA certificate management feature — coolify CWE-78 8.8 High 2026-06-30
CVE-2026-27956 Coolify: Cross-team application domain enumeration via domains_by_server endpoint — coolify CWE-639 4.3 Medium 2026-06-30
CVE-2026-27955 Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()` — coolify CWE-78 6.6 Medium 2026-06-30
CVE-2026-27883 Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure — coolify CWE-639 5.0 Medium 2026-06-30
CVE-2026-27881 Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) — coolify CWE-639 5.0 Medium 2026-06-30
CVE-2026-27882 Coolify: Timing Attack in GitLab Webhook Token Validation — coolify CWE-208 4.8 Medium 2026-06-30
CVE-2026-34592 Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure — coolify CWE-639 7.7 High 2026-06-29
CVE-2026-34594 Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management — coolify CWE-78 8.8 High 2026-06-29
CVE-2026-34597 Coolify: Authenticated Host RCE — coolify CWE-78 8.8 High 2026-06-29
CVE-2026-41896 Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret — coolify CWE-287 7.5 High 2026-06-29
CVE-2026-57498 Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers — coolify CWE-639 9.6 Critical 2026-06-29
CVE-2026-12815 coollabsio coolify Image Name os command injection — coolify CWE-78 6.3 Medium 2026-06-21
CVE-2025-64425 Coolify has host header injection in forgot password — coolify CWE-644 8.0 - 2026-01-05
CVE-2025-64424 Colify has command injection vulnerability in project git source — coolify CWE-77 8.8 - 2026-01-05
CVE-2025-64423 Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links — coolify CWE-287 8.0 - 2026-01-05
CVE-2025-64422 Rate-limit bypass on login via X-Forwarded-Host header — coolify CWE-770 9.8 - 2026-01-05
CVE-2025-64421 Coolify has a privilege escalation - low privileged user can invite themselves as an admin user — coolify CWE-863 8.8 - 2026-01-05
CVE-2025-64420 Coolify members can see private key of root user — coolify CWE-522 10.0 Critical 2026-01-05
CVE-2025-64419 Coolify vulnerable to command injection via docker-compose.yaml parameters — coolify CWE-77 9.7 Critical 2026-01-05
CVE-2025-59955 Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint — coolify CWE-201 7.1 - 2026-01-05
CVE-2025-59158 Coolify has Stored XSS in Project Name — coolify CWE-116 5.4 - 2026-01-05
CVE-2025-59157 Coolify has Git Repository RCE — coolify CWE-78 10.0 Critical 2026-01-05

This page lists every published CVE security advisory associated with coollabsio. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.