Open Source Coolify <4.0.0-beta.474

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical2high0medium0low

updated 2026-10-28

vulnerabilities (41)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-66209US	high8.8	3.88% (90th)	Exploit	no fix	2025-12-23	—
CVE-2026-59734US	—	0.81% (57th)	Exploit	no fix	2026-07-09	—
CVE-2026-34048US	—OT elevated	0.80% (56th)	Exploit	no fix	2026-07-07	—
CVE-2025-66213US	high8.8	3.28% (88th)	—	no fix	2025-12-23	—
CVE-2026-34599US	—	2.80% (86th)	—	no fix	2026-07-06	—
CVE-2026-34594US	—	1.38% (72nd)	—	no fix	2026-06-29	—
CVE-2026-34034US	—	0.78% (56th)	—	no fix	2026-07-07	—
CVE-2026-34153US	—	0.78% (56th)	—	no fix	2026-07-06	—
CVE-2026-34597US	—	0.66% (52nd)	—	no fix	2026-06-29	—
CVE-2026-42200US	—	0.66% (51st)	—	no fix	2026-07-07	—
CVE-2026-34152US	—	0.65% (51st)	—	no fix	2026-07-07	—
CVE-2026-34047US	—OT elevated	0.55% (46th)	—	no fix	2026-07-07	—
CVE-2026-42143US	—	0.53% (45th)	—	no fix	2026-07-07	—
CVE-2026-34168US	—	0.51% (43rd)	—	no fix	2026-07-07	—
CVE-2026-42204US	—	0.46% (39th)	—	no fix	2026-07-06	—
CVE-2026-42153US	—	0.46% (39th)	—	no fix	2026-07-06	—
CVE-2026-34058US	—	0.45% (39th)	—	no fix	2026-07-07	—
CVE-2026-34057US	—	0.44% (38th)	—	no fix	2026-07-07	—
CVE-2026-34035US	—	0.43% (37th)	—	no fix	2026-07-07	—
CVE-2026-34158US	—	0.43% (37th)	—	no fix	2026-07-07	—
CVE-2026-34044US	—	0.40% (34th)	—	no fix	2026-07-07	—
CVE-2026-42145US	—	0.39% (34th)	—	no fix	2026-07-07	—
CVE-2026-34050US	—OT elevated	0.38% (31st)	—	no fix	2026-07-06	—
CVE-2026-34037US	—	0.37% (31st)	—	no fix	2026-07-07	—
CVE-2026-41899US	—OT elevated	0.36% (30th)	—	no fix	2026-07-06	—
CVE-2026-34592US	—	0.34% (27th)	—	no fix	2026-06-29	—
CVE-2026-42147US	—	0.32% (25th)	—	no fix	2026-07-07	—
CVE-2026-27956US	—	0.29% (22nd)	—	no fix	2026-06-30	—
CVE-2026-41896US	—	0.28% (20th)	—	no fix	2026-06-29	—
CVE-2026-34149US	—	0.27% (19th)	—	no fix	2026-07-07	—
CVE-2026-27955US	—	0.27% (19th)	—	no fix	2026-06-30	—
CVE-2026-27883US	—	0.26% (18th)	—	no fix	2026-06-30	—
CVE-2026-32718US	—OT elevated	0.26% (18th)	—	no fix	2026-07-06	—
CVE-2026-34167US	—	0.25% (16th)	—	no fix	2026-07-06	—
CVE-2026-42201US	—	0.24% (15th)	—	no fix	2026-07-07	—
CVE-2026-34049US	—	0.24% (15th)	—	no fix	2026-07-06	—
CVE-2026-42172US	—	0.24% (15th)	—	no fix	2026-07-07	—
CVE-2026-34170US	—	0.21% (11th)	—	no fix	2026-07-07	—
CVE-2026-34171US	—	0.20% (10th)	—	no fix	2026-07-07	—
CVE-2026-42148US	—	0.18% (7th)	—	no fix	2026-07-06	—
CVE-2026-34198US	—	0.17% (6th)	—	no fix	2026-07-07	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')22 CVEs
CWE-639Authorization Bypass Through User-Controlled Key6 CVEs
CWE-770Allocation of Resources Without Limits or Throttling2 CVEs
CWE-862Missing Authorization2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-285Improper Authorization1 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)41 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan