3559 matches found
CVE-2025-22612 Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP ...
CVE-2025-22610 Coolify Vulnerable to OAuth Secrets Leak
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" f...
CVE-2025-22610
Summary: CVE-2025-22610 affects Coolify prior to 4.0.0-beta.361, where missing authorization lets any authenticated user fetch and modify the global OAuth configuration, exposing the OAuth client ID and client secret for every custom provider. Affected component/flow: global Coolify OAuth configu...
CVE-2025-22609
Coolify (open-source self-hosted) is affected for all versions prior to 4.0.0-beta.361. The issue is a missing authorization that allows any authenticated user to attach an existing private key from a Coolify instance to their own server. If the attacker’s target server configuration (IP/domain, ...
CVE-2025-22606
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...
CVE-2025-22607
CVE-2025-22607 concerns Coolify. Before 4.0.0-beta.361, an authenticated user could fetch the details page for any GitHub/GitLab configuration by knowing only the UUID, exposing the client id , client secret , and webhook secret . The issue is fixed in version 4.0.0-beta.361 . Connected sources c...
CVE-2025-22606
CVE-2025-22606 describes a command-injection vulnerability in Coolify caused by unsafely handling project names in versions up to 4.0.0-beta.358 (likely earlier). An attacker with access to project management could inject arbitrary shell commands by including unescaped characters (e.g., a single ...
CVE-2025-22605 Coolify OS Command Injection Vulnerability in SSH Command Generation
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.253, a vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local...
PT-2025-5266 · Coolify · Coolify
Name of the Vulnerable Software and Affected Versions: Coolify versions prior to 4.0.0-beta.380 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. The issue arises when the tags page allows users to search for tags. If the search does...
PT-2025-4591 · Coolify · Coolify
Name of the Vulnerable Software and Affected Versions: Coolify versions 4.0.0-beta.18 through 4.0.0-beta.252 Description: A vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data an...
PT-2025-4592 · Coolify · Coolify
Name of the Vulnerable Software and Affected Versions: Coolify versions 4.0.0-beta.358 and earlier Description: The issue allows attackers to inject arbitrary shell commands by altering the project name, potentially resulting in full system compromise, creation, modification, or deletion of...
PT-2025-4596 · Coolify · Coolify
Name of the Vulnerable Software and Affected Versions: Coolify versions prior to 4.0.0-beta.361 Description: The issue is related to missing authorization, allowing any authenticated user to access and modify the global Coolify instance OAuth configuration. This exposes sensitive information,...
PT-2025-3992 · Beta10 · Beta10
Name of the Vulnerable Software and Affected Versions: Beta10 software affected versions not specified Description: The Beta10 software does not provide proper authorization control in multiple areas of the application, allowing a malicious actor to access private areas and/or areas intended for...
WordPress Blog Summary plugin <= 0.1.2 β - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Blog Summary versions = 0.1.2 β...
notion-go 安全漏洞
notion-go is a collection of libraries that support signing and verifying OCI artifacts for notaryproject individual developers. A security vulnerability exists in notion-go versions 1.2.0-beta.1 through 1.3.0-rc.1, which stems from a failure to validate the revocation status of a certificate whe...
Cross-site Scripting (XSS)
dcat/laravel-admin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the /admin/articles/create endpoint in version 2.2.0-beta, which allows attackers to inject malicious scripts...
Moderate: Red Hat Bug Fix Advisory: Red Hat build of Apicurio Registry 3.0.6 Beta OpenShift images
3.0.6 Beta release of Red Hat build of Apicurio Registry. This advisory makes available an update to the Red Hat build of Apicurio Registry images...
Dcat Admin admin/articles/create interface cross-site scripting vulnerability
Dcat Admin is a second development based on laravel-admin to build the backend system tools . A cross-site scripting vulnerability exists in Dcat Admin v2.2.0-beta, which stems from the lack of effective filtering and escaping of user-supplied data in /admin/articles/create, and can be exploited ...
