CVE-2026-42201

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields redispassword, keydbpassword, dragonflypassword, clickhouseadminuser, clickhouseadminpassword, postgresuser, mysqluser are validated only as...

CVE-2026-34158 Coolify: Command injection via single-quote breakout in Docker Compose custom commands

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a...

CVE-2026-34158

Coolify (open-source self-hosted) prior to version 4.0.0-beta.469 is affected by a command-injection in the executeInDocker() helper. The function wraps user-controlled commands in single quotes, but fails to escape embedded single quotes, enabling an attacker who can edit application settings to...

CVE-2026-34158 Coolify: Command injection via single-quote breakout in Docker Compose custom commands

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a...

CVE-2026-42204

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

CVE-2026-42204

Coolify CVE-2026-42204 affects the 4.0.0-beta.471 to 4.0.0-beta.473 releases, where a regression in the SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields. This enabled an authenticated team member to inject shell commands t...

CVE-2026-42204

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

CVE-2026-42204 Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: trivy, flux-notification-controller, grafana, kueue, zot, crossplane-provider-azure-operationalinsights, longhorn-cli-fips, policy-controller-fips, trivy-operator-fips, mapotf-fips, slsa-verifier, crossplane-provider-aws-kinesis-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: trivy, flux-notification-controller, grafana, kueue, zot, crossplane-provider-azure-operationalinsights, longhorn-cli-fips, policy-controller-fips, trivy-operator-fips, mapotf-fips, slsa-verifier, crossplane-provider-aws-kinesis-fips,...

GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...

Astra Linux – Vulnerability in docker.io-app

Docker Compose relies on the path information embedded in remote OCI Compose artifacts. When a layer includes the annotations com.dockercompose.extends or com.dockercompose.envfile, Compose incorporates the value provided by the attacker from com.dockercompose.file/com.dockercompose.envfile into...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: trivy, zot, k3s, amazon-ecs-agent-fips, chartmuseum-fips, kargo, fuse-overlayfs-snapshotter, trivy-operator-fips, k9s-fips, xeol, beats, consul-k8s, harvester-fips, kaniko-fips, newrelic-infrastructure-agent, kubescape-operator-fips, spegel, kube-mgmt, cloudbeat,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: trivy, zot, k3s, amazon-ecs-agent-fips, chartmuseum-fips, kargo, fuse-overlayfs-snapshotter, trivy-operator-fips, k9s-fips, xeol, beats, consul-k8s, harvester-fips, kaniko-fips, newrelic-infrastructure-agent, kubescape-operator-fips, spegel, kube-mgmt, cloudbeat,...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: trivy, zot, k3s, amazon-ecs-agent-fips, chartmuseum-fips, kargo, fuse-overlayfs-snapshotter, trivy-operator-fips, k9s-fips, xeol, beats, consul-k8s, harvester-fips, kaniko-fips, newrelic-infrastructure-agent, kubescape-operator-fips, spegel, kube-mgmt, cloudbeat,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: trivy, zot, k3s, amazon-ecs-agent-fips, chartmuseum-fips, kargo, fuse-overlayfs-snapshotter, trivy-operator-fips, k9s-fips, xeol, beats, consul-k8s, harvester-fips, kaniko-fips, newrelic-infrastructure-agent, kubescape-operator-fips, spegel, kube-mgmt, cloudbeat,...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: trivy, zot, k3s, amazon-ecs-agent-fips, chartmuseum-fips, kargo, fuse-overlayfs-snapshotter, trivy-operator-fips, k9s-fips, xeol, beats, consul-k8s, harvester-fips, kaniko-fips, newrelic-infrastructure-agent, kubescape-operator-fips, spegel, kube-mgmt, cloudbeat,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: trivy, zot, k3s, amazon-ecs-agent-fips, chartmuseum-fips, kargo, fuse-overlayfs-snapshotter, trivy-operator-fips, k9s-fips, xeol, consul-k8s, harvester-fips, kaniko-fips, newrelic-infrastructure-agent, kubescape-operator-fips, spegel, kube-mgmt, cloudbeat,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: trivy, zot, k3s, amazon-ecs-agent-fips, chartmuseum-fips, kargo, fuse-overlayfs-snapshotter, trivy-operator-fips, k9s-fips, xeol, consul-k8s, harvester-fips, kaniko-fips, newrelic-infrastructure-agent, kubescape-operator-fips, spegel, kube-mgmt, cloudbeat,...

GHSA-WF69-R4MX-43RR AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

Vulnerability Details CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official docker-compose.yml line 61 mounts the entire project root directory as the Apache document root: yaml volumes: - "./:/var/www/html/AVideo" This causes the .env file —...