How many CVEs have patched rules?

5 published CVEs changed rules in coollabsio/coolify, in 21 distinct patches totalling 130 changed lines, between 2026 and 2026.

What is the latest CVE that changed rules?

CVE-2026-59734 (Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution), published 2026-07-09, changed lines 145 to 171 of app/Livewire/Project/Application/General.php.

How does rules compare to the rest of coollabsio/coolify?

coollabsio/coolify has 43 CVEs with a located fix in total; 5 of them changed rules.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

rules in coollabsio/coolify: Patched by 5 CVEs

Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

CVE-2026-59734 · app/Livewire/Project/Application/General.php · lines 145–171 · +11 −11

High · CVSS 8.8

EPSS 0.8%2026-07-09

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Clickhouse/General.php · lines 79–84 · +6 −2

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Dragonfly/General.php · lines 92–94 · +3 −1

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Keydb/General.php · lines 95–97 · +3 −1

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Mariadb/General.php · lines 77–88 · +12 −4

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Mongodb/General.php · lines 78–86 · +9 −3

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Mysql/General.php · lines 79–90 · +12 −4

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Postgresql/General.php · lines 89–97 · +9 −3

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Livewire/Project/Database/Redis/General.php · lines 84–89 · +6 −2

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: SSRF via S3 Storage Endpoint in testConnection()

CVE-2026-42147 · app/Livewire/Storage/Create.php · line 41 · +1 −1

Medium · CVSS 4.9

EPSS 0.4%2026-07-07

Coolify: SSRF via S3 Storage Endpoint in testConnection()

CVE-2026-42147 · app/Livewire/Storage/Form.php · line 46 · +1 −1

Medium · CVSS 4.9

EPSS 0.4%2026-07-07

Coolify read-scoped API tokens can perform state-changing validation operations

CVE-2026-32718 · app/Livewire/Project/Application/General.php · line 187 · +1 −1

Medium · CVSS 6.5

EPSS 0.4%2026-07-06

Coolify authenticated remote command injection leading to RCE and secret exfiltration

CVE-2026-34038 · app/Livewire/Project/Application/General.php · lines 145–171 · +11 −11

Critical · CVSS 9.9

EPSS 2.5%2026-07-06

rules

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track coollabsio/coolify CVEs