CVE-2026-34037

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an...

CVE-2026-34037

Coolify prior to v4.0.0-beta.464 is affected by a broken object-level authorization in cloneTo() within ResourceOperations.php. The action authenticates the source resource but resolves destination resources with unscoped Eloquent lookups, enabling cross-tenant cloning where an authenticated user...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: iouring/rsrc: Validates the buffer count with an offset for cloning. syzbot reports that it can trigger a WARNON when a kmalloc attempt is too large. WARNING: CPU: 0, PID: 6488, at mm/slub.c:5024, kvmallocnodenoprof+0x520/0x64...