{"schema_version":1,"title":"Coollabs vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 49 vulnerabilities in Coollabs: 0 in the last 7 days and 45 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-15507, was published on 12 July 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/coollabs","json_url":"https://junglewise.ai/threats/vendors/coollabs.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/coollabs","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":23,"all_time":49,"critical":6,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":45,"last_365_days":46},"latest":[{"cve":"CVE-2026-15507","cvss":6.3,"slug":"cve-2026-15507-coollabsio-coolify-missing-authorization-in-policy-handler","title":"coollabsio Coolify missing authorization in Policy Handler","severity":"medium","exploited":false,"published_at":"2026-07-12T22:16:35.917+00:00","url":"https://junglewise.ai/threats/cve-2026-15507-coollabsio-coolify-missing-authorization-in-policy-handler"},{"cve":"CVE-2026-59734","cvss":8.8,"slug":"cve-2026-59734-coollabs-coolify-os-command-injection-in-health-check","title":"Coollabs Coolify OS command injection in health check configuration","severity":"high","exploited":false,"published_at":"2026-07-09T18:16:57.473+00:00","url":"https://junglewise.ai/threats/cve-2026-59734-coollabs-coolify-os-command-injection-in-health-check"},{"cve":"CVE-2026-42201","cvss":3.3,"slug":"cve-2026-42201-coolify-os-command-injection-in-database-credential-fields","title":"Coolify OS command injection in database credential fields","severity":"low","exploited":false,"published_at":"2026-07-07T05:16:51.237+00:00","url":"https://junglewise.ai/threats/cve-2026-42201-coolify-os-command-injection-in-database-credential-fields"},{"cve":"CVE-2026-34158","cvss":8.8,"slug":"cve-2026-34158-coolabsio-coolify-os-command-injection-in-docker-compose-commands","title":"Coolabsio Coolify OS command injection in Docker Compose commands","severity":"high","exploited":false,"published_at":"2026-07-07T05:16:50.73+00:00","url":"https://junglewise.ai/threats/cve-2026-34158-coolabsio-coolify-os-command-injection-in-docker-compose-commands"},{"cve":"CVE-2026-42200","cvss":8.8,"slug":"cve-2026-42200-coollabsio-coolify-path-traversal-in-postgresql-init-scripts","title":"Coollabsio Coolify path traversal in PostgreSQL init scripts","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:52.923+00:00","url":"https://junglewise.ai/threats/cve-2026-42200-coollabsio-coolify-path-traversal-in-postgresql-init-scripts"},{"cve":"CVE-2026-42172","cvss":3.1,"slug":"cve-2026-42172-coollabs-coolify-insufficient-session-expiration-for-api-tokens","title":"Coollabs Coolify insufficient session expiration for API tokens","severity":"low","exploited":false,"published_at":"2026-07-07T04:17:52.133+00:00","url":"https://junglewise.ai/threats/cve-2026-42172-coollabs-coolify-insufficient-session-expiration-for-api-tokens"},{"cve":"CVE-2026-42147","cvss":4.9,"slug":"cve-2026-42147-coollabsio-coolify-ssrf-in-s3-storage-endpoint-validation","title":"Coollabsio Coolify SSRF in S3 storage endpoint validation","severity":"medium","exploited":false,"published_at":"2026-07-07T04:17:51.76+00:00","url":"https://junglewise.ai/threats/cve-2026-42147-coollabsio-coolify-ssrf-in-s3-storage-endpoint-validation"},{"cve":"CVE-2026-42145","cvss":3.1,"slug":"cve-2026-42145-coollabsio-coolify-unrestricted-file-upload-in-database-backup","title":"Coollabsio Coolify unrestricted file upload in database backup restore","severity":"low","exploited":false,"published_at":"2026-07-07T04:17:51.353+00:00","url":"https://junglewise.ai/threats/cve-2026-42145-coollabsio-coolify-unrestricted-file-upload-in-database-backup"},{"cve":"CVE-2026-42143","cvss":8.8,"slug":"cve-2026-42143-coollabsio-coolify-os-command-injection-in-persistent-volume","title":"Coollabsio Coolify OS command injection in persistent volume names","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:51.2+00:00","url":"https://junglewise.ai/threats/cve-2026-42143-coollabsio-coolify-os-command-injection-in-persistent-volume"},{"cve":"CVE-2026-34198","cvss":5.3,"slug":"cve-2026-34198-coolify-account-takeover-via-host-header-injection-in-password","title":"Coolify account takeover via host header injection in password reset","severity":"medium","exploited":false,"published_at":"2026-07-07T04:17:50.847+00:00","url":"https://junglewise.ai/threats/cve-2026-34198-coolify-account-takeover-via-host-header-injection-in-password"},{"cve":"CVE-2026-34171","cvss":8,"slug":"cve-2026-34171-coolify-account-takeover-via-csrf-in-invitation-endpoint","title":"Coolify account takeover via CSRF in invitation endpoint","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:50.513+00:00","url":"https://junglewise.ai/threats/cve-2026-34171-coolify-account-takeover-via-csrf-in-invitation-endpoint"},{"cve":"CVE-2026-34170","cvss":4.3,"slug":"cve-2026-34170-coollabsio-coolify-ssrf-in-github-app-configuration","title":"coollabsio Coolify SSRF in GitHub App configuration","severity":"medium","exploited":false,"published_at":"2026-07-07T04:17:50.357+00:00","url":"https://junglewise.ai/threats/cve-2026-34170-coollabsio-coolify-ssrf-in-github-app-configuration"},{"cve":"CVE-2026-34168","cvss":8.8,"slug":"cve-2026-34168-coollabs-coolify-os-command-injection-in-localpersistentvolume","title":"Coollabs Coolify OS command injection in LocalPersistentVolume name","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:50.18+00:00","url":"https://junglewise.ai/threats/cve-2026-34168-coollabs-coolify-os-command-injection-in-localpersistentvolume"},{"cve":"CVE-2026-34152","cvss":8.8,"slug":"cve-2026-34152-coolabsio-coolify-os-command-injection-in-deployment-commands","title":"Coolabsio Coolify OS command injection in deployment commands","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:50.043+00:00","url":"https://junglewise.ai/threats/cve-2026-34152-coolabsio-coolify-os-command-injection-in-deployment-commands"},{"cve":"CVE-2026-34149","cvss":3.3,"slug":"cve-2026-34149-coolify-os-command-injection-in-databasebackupjob","title":"Coolify OS command injection in DatabaseBackupJob","severity":"low","exploited":false,"published_at":"2026-07-07T04:17:49.8+00:00","url":"https://junglewise.ai/threats/cve-2026-34149-coolify-os-command-injection-in-databasebackupjob"},{"cve":"CVE-2026-34058","cvss":8.8,"slug":"cve-2026-34058-coollabsio-coolify-os-command-injection-in-server-resources","title":"Coollabsio Coolify OS command injection in Server Resources","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:49.193+00:00","url":"https://junglewise.ai/threats/cve-2026-34058-coollabsio-coolify-os-command-injection-in-server-resources"},{"cve":"CVE-2026-34057","cvss":8.8,"slug":"cve-2026-34057-coolify-command-injection-in-database-import-component","title":"Coolify command injection in database import component","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:48.647+00:00","url":"https://junglewise.ai/threats/cve-2026-34057-coolify-command-injection-in-database-import-component"},{"cve":"CVE-2026-34048","cvss":9.9,"slug":"cve-2026-34048-coolify-improper-authorization-in-terminal-websocket-routes","title":"Coolify improper authorization in terminal websocket routes","severity":"critical","exploited":false,"published_at":"2026-07-07T04:17:48.417+00:00","url":"https://junglewise.ai/threats/cve-2026-34048-coolify-improper-authorization-in-terminal-websocket-routes"},{"cve":"CVE-2026-34047","cvss":9.9,"slug":"cve-2026-34047-coolify-incorrect-authorization-in-terminal-websocket-routes","title":"Coolify incorrect authorization in terminal WebSocket routes","severity":"critical","exploited":false,"published_at":"2026-07-07T04:17:48.287+00:00","url":"https://junglewise.ai/threats/cve-2026-34047-coolify-incorrect-authorization-in-terminal-websocket-routes"},{"cve":"CVE-2026-34044","cvss":7.7,"slug":"cve-2026-34044-coolify-idor-in-logs-component-allows-cross-team-log-access","title":"Coolify IDOR in Logs component allows cross-team log access","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:48.153+00:00","url":"https://junglewise.ai/threats/cve-2026-34044-coolify-idor-in-logs-component-allows-cross-team-log-access"},{"cve":"CVE-2026-34037","cvss":9.9,"slug":"cve-2026-34037-coolify-cross-tenant-resource-cloning-in-resourceoperations-php","title":"Coolify cross-tenant resource cloning in ResourceOperations.php","severity":"critical","exploited":false,"published_at":"2026-07-07T04:17:48.02+00:00","url":"https://junglewise.ai/threats/cve-2026-34037-coolify-cross-tenant-resource-cloning-in-resourceoperations-php"},{"cve":"CVE-2026-34035","cvss":8.8,"slug":"cve-2026-34035-coollabsio-coolify-command-injection-in-log-drain-configuration","title":"coollabsio Coolify command injection in Log Drain configuration","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:47.873+00:00","url":"https://junglewise.ai/threats/cve-2026-34035-coollabsio-coolify-command-injection-in-log-drain-configuration"},{"cve":"CVE-2026-34034","cvss":8.8,"slug":"cve-2026-34034-coolify-os-command-injection-in-sentinel-token-settings","title":"Coolify OS command injection in Sentinel token settings","severity":"high","exploited":false,"published_at":"2026-07-07T04:17:47.603+00:00","url":"https://junglewise.ai/threats/cve-2026-34034-coolify-os-command-injection-in-sentinel-token-settings"},{"cve":"CVE-2026-42204","cvss":8.8,"slug":"cve-2026-42204-coolify-os-command-injection-in-docker-compose-command-fields","title":"Coolify OS command injection in Docker Compose command fields","severity":"high","exploited":false,"published_at":"2026-07-06T22:16:49.51+00:00","url":"https://junglewise.ai/threats/cve-2026-42204-coolify-os-command-injection-in-docker-compose-command-fields"},{"cve":"CVE-2026-42153","cvss":8.8,"slug":"cve-2026-42153-coollabsio-coolify-os-command-injection-in-postgresql-healthcheck","title":"coollabsio Coolify OS command injection in PostgreSQL healthcheck","severity":"high","exploited":false,"published_at":"2026-07-06T22:16:49.383+00:00","url":"https://junglewise.ai/threats/cve-2026-42153-coollabsio-coolify-os-command-injection-in-postgresql-healthcheck"}],"vendor":{"hub":true,"name":"Coollabs","slug":"coollabs","homepage":"https://coolify.io/","description":"The organization behind the Coolify self-hosting platform.","url":"https://junglewise.ai/threats/vendors/coollabs"},"weekly":[{"week":"2026-06-29","critical":1,"exploited":0,"vulnerabilities":11},{"week":"2026-07-06","critical":4,"exploited":0,"vulnerabilities":34},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-34048","cvss":9.9,"slug":"cve-2026-34048-coolify-improper-authorization-in-terminal-websocket-routes","title":"Coolify improper authorization in terminal websocket routes","severity":"critical","exploited":false,"published_at":"2026-07-07T04:17:48.417+00:00","url":"https://junglewise.ai/threats/cve-2026-34048-coolify-improper-authorization-in-terminal-websocket-routes"},{"cve":"CVE-2026-34047","cvss":9.9,"slug":"cve-2026-34047-coolify-incorrect-authorization-in-terminal-websocket-routes","title":"Coolify incorrect authorization in terminal WebSocket routes","severity":"critical","exploited":false,"published_at":"2026-07-07T04:17:48.287+00:00","url":"https://junglewise.ai/threats/cve-2026-34047-coolify-incorrect-authorization-in-terminal-websocket-routes"},{"cve":"CVE-2026-34037","cvss":9.9,"slug":"cve-2026-34037-coolify-cross-tenant-resource-cloning-in-resourceoperations-php","title":"Coolify cross-tenant resource cloning in ResourceOperations.php","severity":"critical","exploited":false,"published_at":"2026-07-07T04:17:48.02+00:00","url":"https://junglewise.ai/threats/cve-2026-34037-coolify-cross-tenant-resource-cloning-in-resourceoperations-php"},{"cve":"CVE-2026-34038","cvss":9.9,"slug":"cve-2026-34038-coollabsio-coolify-command-injection-in-application-deployment","title":"Coollabsio Coolify command injection in application deployment handling","severity":"critical","exploited":false,"published_at":"2026-07-06T21:16:55.37+00:00","url":"https://junglewise.ai/threats/cve-2026-34038-coollabsio-coolify-command-injection-in-application-deployment"},{"cve":"CVE-2026-57498","cvss":9.6,"slug":"cve-2026-57498-coolify-authorization-bypass-in-livewire-ui-components","title":"Coolify authorization bypass in Livewire UI components","severity":"critical","exploited":false,"published_at":"2026-06-29T20:17:40.013+00:00","url":"https://junglewise.ai/threats/cve-2026-57498-coolify-authorization-bypass-in-livewire-ui-components"},{"cve":"CVE-2025-34157","cvss":9,"epss":0.0045,"slug":"cve-2025-34157-coollabs-coolify-stored-xss-in-project-creation-workflow","title":"Coollabs Coolify stored XSS in project creation workflow","severity":"critical","exploited":false,"published_at":"2025-08-27T17:15:37.93+00:00","url":"https://junglewise.ai/threats/cve-2025-34157-coollabs-coolify-stored-xss-in-project-creation-workflow"},{"cve":"CVE-2025-34161","cvss":8.8,"epss":0.0369,"slug":"cve-2025-34161-coollabsio-coolify-remote-code-execution-in-git-repository-field","title":"coollabsio Coolify remote code execution in Git Repository field","severity":"high","exploited":false,"published_at":"2025-08-27T17:15:38.297+00:00","url":"https://junglewise.ai/threats/cve-2025-34161-coollabsio-coolify-remote-code-execution-in-git-repository-field"},{"cve":"CVE-2025-34159","cvss":8.8,"epss":0.0092,"slug":"cve-2025-34159-coolabs-coolify-remote-code-execution-via-docker-compose","title":"Coolabs Coolify remote code execution via Docker Compose injection","severity":"high","exploited":false,"published_at":"2025-08-27T17:15:38.123+00:00","url":"https://junglewise.ai/threats/cve-2025-34159-coolabs-coolify-remote-code-execution-via-docker-compose"},{"cve":"CVE-2026-59734","cvss":8.8,"slug":"cve-2026-59734-coollabs-coolify-os-command-injection-in-health-check","title":"Coollabs Coolify OS command injection in health check configuration","severity":"high","exploited":false,"published_at":"2026-07-09T18:16:57.473+00:00","url":"https://junglewise.ai/threats/cve-2026-59734-coollabs-coolify-os-command-injection-in-health-check"},{"cve":"CVE-2026-34158","cvss":8.8,"slug":"cve-2026-34158-coolabsio-coolify-os-command-injection-in-docker-compose-commands","title":"Coolabsio Coolify OS command injection in Docker Compose commands","severity":"high","exploited":false,"published_at":"2026-07-07T05:16:50.73+00:00","url":"https://junglewise.ai/threats/cve-2026-34158-coolabsio-coolify-os-command-injection-in-docker-compose-commands"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Coollabs Coolify","slug":"coolify","vulnerabilities":51,"url":"https://junglewise.ai/threats/technologies/coolify"}]}