Latest security vulnerabilities, research findings, and insights from our security research team.
A critical argument-injection flaw in Coolify's realtime terminal (GHSA-jq58-rxhg-623r) let any authenticated user run code as root on the shared coolify-realtime container, exposing every co-tenant's SSH keys. Root cause, proof of concept, the v4.3.15 fix, and the disclosure timeline.
Four cross-tenant authorization vulnerabilities in Coolify let any team member steal other teams' SSH and GitHub App keys, issue live GitHub tokens, and delete environments. Full technical analysis, PoCs, and the v4.1.1 fixes.
Critical security vulnerability discovered in JumpServer allowing unauthorized access to connection tokens via API endpoint. Learn about the technical details, exploitation methods, and root cause analysis.
High-severity vulnerability in JumpServer allowing low-privilege users to extract LDAP credentials via WebSocket endpoint. Detailed analysis of the exploitation method and root cause.
