1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
  1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 10, 2026, 4:35 AM 16,373 active 1,443 known exploited

Catalog summary

16,373

Active CVEs

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 10, 2026, 4:35 AM 16,373 active 1,443 known exploited

Catalog summary

16,373

Active CVEs

8,465

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 4,701–4,750 of 16,373 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-11610High
    389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind
    CVSS 8.8
    389ds/389-ds-basegeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  2. CVE-2026-14476High
    Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass
    CVSS 8.0
    Affected software not mappedEcosystem not listed
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Aug 4, 2026View HOL analysis
  3. CVE-2026-14474High
    Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
    CVSS 8.8
    Affected software not mappedEcosystem not listed
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Aug 4, 2026View HOL analysis
  4. CVE-2026-13199Medium
    Insufficient Entropy in Raspberry Pi 5 and Compute Module 5
    CVSS 5.1
    Raspberry Pi/Raspberry Pi 5 and Compute Module 5generic
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  5. CVE-2026-4375Critical
    DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE
    CVSS 9.0
    Unknown/DoLeads Integrator, Unknown/wp2epubgeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  6. CVE-2026-12375Critical
    Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server
    CVSS 9.8
    Unknown/uncanny-automator-progeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  7. CVE-2026-12277High
    Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
    CVSS 8.7
    Unknown/Frontend File Manager Plugingeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  8. CVE-2026-10834Medium
    WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image
    CVSS 4.6
    Unknown/WP Travel Enginegeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  9. CVE-2026-14345Critical
    WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
    CVSS 9.8
    getwpfunnels/WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsellgeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  10. CVE-2026-27844Low
    CISA ADP Vulnrichment
    CVSS 2.7
    Gallagher/Controller 7000 and 6000generic
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  11. CVE-2026-27790Low
    CISA ADP Vulnrichment
    CVSS 2.7
    Gallagher/T-20 Readersgeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  12. CVE-2026-26053Medium
    CISA ADP Vulnrichment
    CVSS 5.3
    Gallagher/Command Centre Servergeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  13. CVE-2026-42201Low
    Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands
    CVSS 3.3
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  14. CVE-2026-34158High
    Coolify: Command injection via single-quote breakout in Docker Compose custom commands
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  15. CVE-2026-34170Medium
    Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
    CVSS 4.3
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  16. CVE-2026-34037Critical
    Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()
    CVSS 9.9
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  17. CVE-2026-34048Critical
    Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers
    CVSS 9.9
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  18. CVE-2026-34057High
    Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  19. CVE-2026-42143High
    Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  20. CVE-2026-42147Medium
    Coolify: SSRF via S3 Storage Endpoint in testConnection()
    CVSS 4.9
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  21. CVE-2026-34044High
    Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)
    CVSS 7.7
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 9, 2026View HOL analysis
  22. CVE-2026-34152High
    Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 9, 2026View HOL analysis
  23. CVE-2026-34149Low
    Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs
    CVSS 3.3
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  24. CVE-2026-34171High
    Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value
    CVSS 8.0
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  25. CVE-2026-34034High
    Coolify: Host RCE via Sentinel token injection
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  26. CVE-2026-34168High
    Coolify: Command injection via unsanitized persistent storage name in docker volume commands
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  27. CVE-2026-42145Low
    Coolify: File Upload Without Type or Size Validation in Database Backup Restore
    CVSS 3.1
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 9, 2026View HOL analysis
  28. CVE-2026-34198Medium
    Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing
    CVSS 5.3
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  29. CVE-2026-34058High
    Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  30. CVE-2026-34035High
    Coolify: Host RCE via Log Drain secret/env command injection
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  31. CVE-2026-34047Critical
    Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution
    CVSS 9.9
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  32. CVE-2026-42172Low
    Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access
    CVSS 3.1
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  33. CVE-2026-42200High
    Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  34. CVE-2026-11328Medium
    Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
    CVSS 6.4
    timstrifler/Exclusive Addons for Elementorgeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  35. CVE-2026-36162Medium
    CISA ADP Vulnrichment
    CVSS 5.4
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  36. CVE-2026-36163Medium
    CISA ADP Vulnrichment
    CVSS 5.4
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  37. CVE-2026-37270Critical
    CISA ADP Vulnrichment
    CVSS 9.8
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  38. CVE-2026-37271Critical
    CISA ADP Vulnrichment
    CVSS 9.8
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  39. CVE-2026-50810Medium
    CISA ADP Vulnrichment
    CVSS 5.5
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  40. CVE-2026-50811Medium
    CISA ADP Vulnrichment
    CVSS 6.5
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  41. CVE-2026-51937High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  42. CVE-2024-56141Medium
    Minosoft has IV equal to key
    CVSS 5.0
    Bixilon/Minosoftgeneric
    PublishedJul 6, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  43. CVE-2026-13356Medium
    Interrupted navigation could allow address bar origin spoofing in Firefox for iOS
    CVSS 6.3
    Affected software not mappedEcosystem not listed
    PublishedJul 6, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  44. CVE-2026-53641Medium
    FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
    CVSS 4.8
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  45. CVE-2026-43928Low
    FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment
    CVSS 2.3
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  46. CVE-2026-43927Medium
    FOSSBilling has race condition in cart checkout that bypasses promo code usage limits
    CVSS 6.9
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  47. CVE-2026-43925Medium
    FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use
    CVSS 6.9
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  48. CVE-2026-43921High
    FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
    CVSS 8.9
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  49. CVE-2026-42153High
    Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  50. CVE-2026-34167Medium
    Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor
    CVSS 5.0
    coollabsio/coolifygeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 8, 2026View HOL analysis
Page 95 of 328
Previous9394959697Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard

8,465

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 4,701–4,750 of 16,373 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-11610High
    389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind
    CVSS 8.8
    389ds/389-ds-basegeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  2. CVE-2026-14476High
    Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass
    CVSS 8.0
    Affected software not mappedEcosystem not listed
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Aug 4, 2026View HOL analysis
  3. CVE-2026-14474High
    Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
    CVSS 8.8
    Affected software not mappedEcosystem not listed
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Aug 4, 2026View HOL analysis
  4. CVE-2026-13199Medium
    Insufficient Entropy in Raspberry Pi 5 and Compute Module 5
    CVSS 5.1
    Raspberry Pi/Raspberry Pi 5 and Compute Module 5generic
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  5. CVE-2026-4375Critical
    DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE
    CVSS 9.0
    Unknown/DoLeads Integrator, Unknown/wp2epubgeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  6. CVE-2026-12375Critical
    Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server
    CVSS 9.8
    Unknown/uncanny-automator-progeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  7. CVE-2026-12277High
    Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
    CVSS 8.7
    Unknown/Frontend File Manager Plugingeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  8. CVE-2026-10834Medium
    WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image
    CVSS 4.6
    Unknown/WP Travel Enginegeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  9. CVE-2026-14345Critical
    WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
    CVSS 9.8
    getwpfunnels/WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsellgeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  10. CVE-2026-27844Low
    CISA ADP Vulnrichment
    CVSS 2.7
    Gallagher/Controller 7000 and 6000generic
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  11. CVE-2026-27790Low
    CISA ADP Vulnrichment
    CVSS 2.7
    Gallagher/T-20 Readersgeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  12. CVE-2026-26053Medium
    CISA ADP Vulnrichment
    CVSS 5.3
    Gallagher/Command Centre Servergeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026 Fix availableView HOL analysis
  13. CVE-2026-42201Low
    Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands
    CVSS 3.3
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  14. CVE-2026-34158High
    Coolify: Command injection via single-quote breakout in Docker Compose custom commands
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  15. CVE-2026-34170Medium
    Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
    CVSS 4.3
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  16. CVE-2026-34037Critical
    Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()
    CVSS 9.9
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  17. CVE-2026-34048Critical
    Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers
    CVSS 9.9
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  18. CVE-2026-34057High
    Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  19. CVE-2026-42143High
    Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  20. CVE-2026-42147Medium
    Coolify: SSRF via S3 Storage Endpoint in testConnection()
    CVSS 4.9
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  21. CVE-2026-34044High
    Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)
    CVSS 7.7
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 9, 2026View HOL analysis
  22. CVE-2026-34152High
    Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 9, 2026View HOL analysis
  23. CVE-2026-34149Low
    Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs
    CVSS 3.3
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  24. CVE-2026-34171High
    Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value
    CVSS 8.0
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  25. CVE-2026-34034High
    Coolify: Host RCE via Sentinel token injection
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  26. CVE-2026-34168High
    Coolify: Command injection via unsanitized persistent storage name in docker volume commands
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  27. CVE-2026-42145Low
    Coolify: File Upload Without Type or Size Validation in Database Backup Restore
    CVSS 3.1
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 9, 2026View HOL analysis
  28. CVE-2026-34198Medium
    Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing
    CVSS 5.3
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  29. CVE-2026-34058High
    Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  30. CVE-2026-34035High
    Coolify: Host RCE via Log Drain secret/env command injection
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  31. CVE-2026-34047Critical
    Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution
    CVSS 9.9
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  32. CVE-2026-42172Low
    Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access
    CVSS 3.1
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  33. CVE-2026-42200High
    Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  34. CVE-2026-11328Medium
    Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
    CVSS 6.4
    timstrifler/Exclusive Addons for Elementorgeneric
    PublishedJul 7, 2026First seen at HOL Jul 7, 2026Updated Jul 7, 2026View HOL analysis
  35. CVE-2026-36162Medium
    CISA ADP Vulnrichment
    CVSS 5.4
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  36. CVE-2026-36163Medium
    CISA ADP Vulnrichment
    CVSS 5.4
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  37. CVE-2026-37270Critical
    CISA ADP Vulnrichment
    CVSS 9.8
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  38. CVE-2026-37271Critical
    CISA ADP Vulnrichment
    CVSS 9.8
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  39. CVE-2026-50810Medium
    CISA ADP Vulnrichment
    CVSS 5.5
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  40. CVE-2026-50811Medium
    CISA ADP Vulnrichment
    CVSS 6.5
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  41. CVE-2026-51937High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedJul 7, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  42. CVE-2024-56141Medium
    Minosoft has IV equal to key
    CVSS 5.0
    Bixilon/Minosoftgeneric
    PublishedJul 6, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  43. CVE-2026-13356Medium
    Interrupted navigation could allow address bar origin spoofing in Firefox for iOS
    CVSS 6.3
    Affected software not mappedEcosystem not listed
    PublishedJul 6, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  44. CVE-2026-53641Medium
    FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
    CVSS 4.8
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 7, 2026Updated Jul 8, 2026View HOL analysis
  45. CVE-2026-43928Low
    FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment
    CVSS 2.3
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  46. CVE-2026-43927Medium
    FOSSBilling has race condition in cart checkout that bypasses promo code usage limits
    CVSS 6.9
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  47. CVE-2026-43925Medium
    FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use
    CVSS 6.9
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  48. CVE-2026-43921High
    FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
    CVSS 8.9
    FOSSBilling/FOSSBillinggeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  49. CVE-2026-42153High
    Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container
    CVSS 8.8
    coollabsio/coolifygeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 7, 2026View HOL analysis
  50. CVE-2026-34167Medium
    Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor
    CVSS 5.0
    coollabsio/coolifygeneric
    PublishedJul 6, 2026First seen at HOL Jul 6, 2026Updated Jul 8, 2026View HOL analysis
Page 95 of 328
Previous9394959697Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard