Product by coolLabs Technologies
coolLabs Technologies Coolify
28 known vulnerabilities in coolLabs Technologies Coolify (coolLabs Technologies), 0 of them actively exploited (CISA KEV).
Key figures
28
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
17
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-66209 | Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup | 10.0 | |
| Critical | CVE-2025-66213 | Coolify: OS Command Injection | 8.8 | |
| Critical | CVE-2025-66212 | Coolify: OS Command Injection | 8.8 | |
| Critical | CVE-2025-66211 | Coolify: OS Command Injection | 8.8 | |
| Critical | CVE-2025-66210 | Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import | 8.8 | |
| Critical | CVE-2025-34161 | Coolify Git Repository Field Command Injection in Project Deployment Workflow | 8.8 | |
| Critical | CVE-2025-64424 | Colify has command injection vulnerability in project git source | 8.8 | |
| Critical | CVE-2025-59157 | Coolify has Git Repository RCE | 10.0 | |
| Critical | CVE-2025-59156 | Coolify has Docker Compose Injection issue | 8.8 | |
| Critical | CVE-2025-34159 | Coolify Docker Compose Directive Injection in Application Deployment Workflow | 8.8 | |
| Critical | CVE-2025-64419 | Coolify vulnerable to command injection via docker-compose.yaml parameters | 9.7 | |
| Critical | CVE-2025-22609 | Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) | 10.0 | |
| Critical | CVE-2025-64420 | Coolify members can see private key of root user | 10.0 | |
| Critical | CVE-2025-22612 | Coolify: Exposure of Sensitive Information to an Unauthorized Actor | 10.0 | |
| Critical | CVE-2025-59158 | Coolify has Stored XSS in Project Name | 8.0 | |
| Critical | CVE-2025-22611 | Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE) | 10.0 | |
| Critical | CVE-2025-34157 | Coolify Stored Cross-Site Scripting (XSS) in Project Name Field | 9.0 | |
| High | CVE-2025-64425 | Coolify has host header injection in forgot password | 8.1 | |
| High | CVE-2025-22605 | Coolify OS Command Injection Vulnerability in SSH Command Generation | 7.8 | |
| High | CVE-2025-64423 | Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links | 8.8 | |
| High | CVE-2025-64421 | Coolify has a privilege escalation - low privileged user can invite themselves as an admin user | 8.0 | |
| High | CVE-2025-22606 | Coolify Command Injection Vulnerability in Project Name | 7.8 | |
| Medium | CVE-2025-22610 | Coolify Vulnerable to OAuth Secrets Leak | 6.5 | |
| Medium | CVE-2025-22608 | Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) | 6.5 | |
| Medium | CVE-2025-59955 | Coolify: Insertion of Sensitive Information Into Sent Data | 5.7 |