How many CVEs have patched messages?

5 published CVEs changed messages in coollabsio/coolify, in 22 distinct patches totalling 74 changed lines, between 2026 and 2026.

What is the latest CVE that changed messages?

CVE-2026-59734 (Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution), published 2026-07-09, changed lines 194 to 201 of app/Livewire/Project/Application/General.php.

How does messages compare to the rest of coollabsio/coolify?

coollabsio/coolify has 43 CVEs with a located fix in total; 5 of them changed messages.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

messages in coollabsio/coolify: Patched by 5 CVEs

Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

CVE-2026-59734 · app/Livewire/Project/Application/General.php · lines 194–201 · +8 −0

High · CVSS 8.8

EPSS 0.8%2026-07-09

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Clickhouse/General.php · lines 103–104 · +2 −4

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Dragonfly/General.php · line 114 · +1 −2

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Keydb/General.php · line 119 · +1 −2

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Mariadb/General.php · lines 108–111 · +4 −4

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Mongodb/General.php · lines 106–108 · +3 −3

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Mysql/General.php · lines 111–114 · +4 −4

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Postgresql/General.php · lines 121–123 · +3 −3

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Redis/General.php · lines 107–108 · +2 −2

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: SSRF via S3 Storage Endpoint in testConnection()

CVE-2026-42147 · app/Livewire/Storage/Create.php · line 59 · +0 −1

Medium · CVSS 4.9

EPSS 0.4%2026-07-07

Coolify: SSRF via S3 Storage Endpoint in testConnection()

CVE-2026-42147 · app/Livewire/Storage/Form.php · line 64 · +0 −1

Medium · CVSS 4.9

EPSS 0.4%2026-07-07

Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

CVE-2026-42204 · app/Livewire/Project/Application/General.php · lines 200–205 · +6 −6

High · CVSS 8.8

EPSS 0.7%2026-07-06

Coolify authenticated remote command injection leading to RCE and secret exfiltration

CVE-2026-34038 · app/Livewire/Project/Application/General.php · lines 194–201 · +8 −0

Critical · CVSS 9.9

EPSS 2.5%2026-07-06

messages

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track coollabsio/coolify CVEs