https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:15:25.856307+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-34049 CVE-2026-34049 — Coolify: Command Injection via unsanitized MongoDB collection names in database backup 2026-10-06T20:15:25.880707+00:00

Affected: coollabsio coolify

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.