coollabsio coolify

Name: coollabsio coolify
Brand: coollabsio

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical16high4medium0low

updated 2026-10-28

vulnerabilities (71)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-66209US	high8.8	3.88% (90th)	Exploit	no fix	2025-12-23	≤ < 4.0.0-beta.451
CVE-2026-34038US	—	2.54% (85th)	Exploit	no fix	2026-07-06	≤ < 4.0.0-beta.469
CVE-2025-64424US	high8.8	2.06% (81st)	Exploit	no fix	2026-01-05	≤ ≤ 4.0.0-beta.434
CVE-2026-59734US	—	0.81% (57th)	Exploit	no fix	2026-07-09	≤ < 4.0.0-beta.469
CVE-2026-34048US	—OT elevated	0.80% (56th)	Exploit	no fix	2026-07-07	≤ < 4.0.0-beta.471
CVE-2025-66213US	high8.8	3.28% (88th)	—	no fix	2025-12-23	≤ < 4.0.0-beta.451
CVE-2025-66212US	high8.8	3.25% (88th)	—	no fix	2025-12-23	≤ < 4.0.0-beta.451
CVE-2025-66211US	high8.8	2.85% (87th)	—	no fix	2025-12-23	≤ < 4.0.0-beta.451
CVE-2025-66210US	high8.8	2.85% (87th)	—	no fix	2025-12-23	≤ < 4.0.0-beta.451
CVE-2026-34599US	—	2.80% (86th)	—	no fix	2026-07-06	≤ < 4.0.0-beta.471
CVE-2025-59157US	high8.8	1.82% (79th)	—	no fix	2026-01-05	≤ < 4.0.0-beta.420.7
CVE-2026-12815US	—	1.70% (77th)	—	no fix	2026-06-22	≤ 4.0.0
CVE-2026-34594US	—	1.38% (72nd)	—	no fix	2026-06-29	≤ < 4.0.0-beta.471
CVE-2025-59156US	high8.8	1.00% (63rd)	—	no fix	2026-01-05	≤ < 4.0.0-beta.420.7
CVE-2026-27957US	—	0.81% (57th)	—	no fix	2026-06-30	≤ < 4.0.0-beta.464
CVE-2026-34034US	—	0.78% (56th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.466
CVE-2026-34153US	—	0.78% (56th)	—	no fix	2026-07-06	≤ < 4.0.0-beta.471
CVE-2025-22609US	—OT elevated	0.75% (55th)	—	no fix	2025-01-24	≤ < 4.0.0-beta.361
CVE-2026-34597US	—	0.66% (51st)	—	no fix	2026-06-29	≤ < 4.0.0-beta.470
CVE-2026-42200US	—	0.66% (51st)	—	no fix	2026-07-07	≤ < 4.0.0-beta.474
CVE-2025-64419US	high8.8	0.65% (51st)	—	no fix	2026-01-05	≤ < 4.0.0-beta.445
CVE-2026-34152US	—	0.65% (51st)	—	no fix	2026-07-07	≤ < 4.0.0-beta.471
CVE-2025-22612US	—OT elevated	0.62% (49th)	—	no fix	2025-01-24	≤ < 4.0.0-beta.374
CVE-2026-34047US	—OT elevated	0.55% (46th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.471
CVE-2026-42143US	—	0.53% (45th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.471
CVE-2025-64420US	high8.8	0.53% (44th)	—	no fix	2026-01-05	≤ ≤ 4.0.0-beta.434
CVE-2025-22605US	high7.8	0.52% (44th)	—	4.0.0-beta.253	2025-01-24	4.0.0-beta.18, → 4.0.0-beta.253
CVE-2026-34168US	—	0.51% (43rd)	—	no fix	2026-07-07	≤ < 4.0.0-beta.471
CVE-2025-59158US	high8.0	0.50% (43rd)	—	no fix	2026-01-05	≤ < 4.0.0-beta.420.7
CVE-2025-22611US	—OT elevated	0.49% (42nd)	—	no fix	2025-01-24	≤ < 4.0.0-beta.361
CVE-2026-42204US	—	0.46% (39th)	—	4.0.0-beta.474	2026-07-06	4.0.0-beta.471, → 4.0.0-beta.474
CVE-2026-42153US	—	0.46% (39th)	—	no fix	2026-07-06	≤ < 4.0.0-beta.474
CVE-2026-34058US	—	0.45% (39th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.471
CVE-2026-34057US	—	0.44% (38th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.471
CVE-2026-34035US	—	0.43% (37th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.466
CVE-2026-34158US	—	0.43% (37th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.469
CVE-2025-64425US	high8.1	0.43% (37th)	—	no fix	2026-01-05	≤ ≤ 4.0.0-beta.434
CVE-2026-34044US	—	0.40% (34th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.466
CVE-2026-42145US	—	0.39% (33rd)	—	no fix	2026-07-07	≤ < 4.0.0-beta.474
CVE-2025-22610US	medium6.5OT elevated	0.39% (33rd)	—	no fix	2025-01-24	≤ < 4.0.0-beta.361
CVE-2026-34050US	—OT elevated	0.38% (31st)	—	no fix	2026-07-06	≤ < 4.0.0-beta.471
CVE-2026-34037US	—	0.37% (31st)	—	no fix	2026-07-07	≤ < 4.0.0-beta.464
CVE-2026-41899US	—OT elevated	0.36% (30th)	—	no fix	2026-07-06	≤ < 4.0.0-beta.474
CVE-2025-22608US	—OT elevated	0.36% (30th)	—	no fix	2025-01-24	≤ < 4.0.0-beta.361
CVE-2025-64423US	high8.8	0.35% (28th)	—	no fix	2026-01-05	≤ ≤ 4.0.0-beta.434
CVE-2026-15507US	—OT elevated	0.35% (28th)	—	no fix	2026-07-12	2 versions
CVE-2026-34592US	—	0.34% (27th)	—	no fix	2026-06-29	≤ < 4.0.0-beta.471
CVE-2026-42147US	—	0.32% (25th)	—	no fix	2026-07-07	≤ < 4.0.0-beta.474
CVE-2026-57498US	—OT elevated	0.32% (24th)	—	no fix	2026-06-29	≤ < 4.0.0-beta.474
CVE-2025-64422US	medium4.3	0.31% (23rd)	—	no fix	2026-01-05	≤ 4.0.0-beta.434

showing 50 of 71

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')32 CVEs
CWE-862Missing Authorization10 CVEs
CWE-639Authorization Bypass Through User-Controlled Key9 CVEs
CWE-863Incorrect Authorization4 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')3 CVEs
CWE-770Allocation of Resources Without Limits or Throttling3 CVEs
CWE-116Improper Encoding or Escaping of Output2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)71 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan