CO
Vendor
coder
42
CVEs
0
On KEV
12
New 30D
Products
CO9.1
coder
coder
36 CVEs0 on KEV12 new
CO9.3
code-server
coder
4 CVEs0 on KEV0 new
AG6.5
agentapi
coder
1 CVEs0 on KEV0 new
CO6.5
code-marketplace
coder
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118687 New | CO coder coder | 6.5 | Oct 28 | Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication |
| CVE-2026-111934 | CO coder coder | 3.7 | Oct 17 | Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header |
| CVE-2026-111933 | CO coder coder | 3.7 | Oct 17 | Coder before 2.34.2 User Enumeration via Login Placeholder Hash |
| CVE-2026-111932 | CO coder coder | 3.4 | Oct 17 | Coder before 2.34.2 Stored HTML Injection via Appearance Settings |
| CVE-2026-111931 | CO coder coder | 4.3 | Oct 17 | Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy |
| CVE-2026-111930 | CO coder coder | 4.3 | Oct 17 | Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint |
| CVE-2026-111929 | CO coder coder | 5.3 | Oct 17 | Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC |
| CVE-2026-111928 | CO coder coder | 5.4 | Oct 17 | Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy |
| CVE-2026-111927 | CO coder coder | 7.7 | Oct 17 | Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match |
| CVE-2026-111926 | CO coder coder | 3.3 | Oct 17 | Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest |
| CVE-2025-71435 | CO coder coder | 4.2 | Oct 17 | Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token |
| CVE-2024-58398 | CO coder coder | 4.3 | Oct 17 | Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter |
| CVE-2026-63443 | CO coder coder | 8.3 | Sep 15 | Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write |
| CVE-2026-55438 | CO coder coder | 6.8 | Jul 8 | Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing |
| CVE-2026-55437 | CO coder coder | 5.4 | Jul 8 | Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component |
| CVE-2026-55436 | CO coder coder | 7.4 | Jul 8 | Coder's AI Bridge Proxy skips TLS certificate verification in default configuration |
| CVE-2026-55433 | CO coder coder | 5.4 | Jul 8 | Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers |
| CVE-2026-55432 | CO coder coder | 5.4 | Jul 8 | Coder's sub-agent app registration bypasses template port-sharing policy enforcement |
| CVE-2026-55431 | CO coder coder | 6.1 | Jul 8 | Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps |
| CVE-2026-55430 | CO coder coder | 6.8 | Jul 8 | Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access |
| CVE-2026-55429 | CO coder coder | 8.7 | Jul 8 | Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID |
| CVE-2026-55428 | CO coder coder | 8.2 | Jul 7 | Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator |
| CVE-2026-55427 | CO coder coder | 8.3 | Jul 7 | Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` |
| CVE-2026-55079 | CO coder coder | 6.5 | Jul 7 | Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service |
| CVE-2026-55078 | CO coder coder | 6.5 | Jul 7 | Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service |
| CVE-2026-55077 | CO coder coder | 7.2 | Jul 7 | Coder: User-admin role can reset owner account password |
| CVE-2026-55076 | CO coder coder | 7.4 | Jul 7 | Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking |
| CVE-2026-55075 | CO coder coder | 7.4 | Jul 7 | Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass |
| CVE-2026-46354 | CO coder coder | 9.1 | Jul 7 | Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft |
| CVE-2026-45796 | CO coder coder | 6.5 | Jul 7 | Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint |
| CVE-2026-44454 | CO coder coder | 8.8 | Jul 7 | Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent |
| CVE-2026-55434 | CO coder coder | 6.5 | Jul 7 | Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints |
| CVE-2026-55435 | CO coder coder | 5.4 | Jul 7 | Suspended Coder users retain access to AI Bridge LLM proxy endpoints |
| CVE-2026-35454 | CO code-marketplace coder | 6.5 | Apr 6 | Code Extension Marketplace has a Zip Slip Path Traversal |
| CVE-2025-66411 | CO coder coder | 5.5 | Dec 3 | Coder logged sensitive objects unsanitized |
| CVE-2025-59956 | AG agentapi coder | 6.5 | Sep 29 | AgentAPI exposed user chat history via a DNS rebinding attack |
| CVE-2025-58437 | CO coder coder | 8.1 | Sep 6 | Coder's privilege escalation vulnerability could lead to a cross workspace compromise |
| CVE-2025-47269 | CO code-server coder | 8.3 | May 9 | code-server session cookie can be extracted by having user visit specially crafted proxy URL |
| CVE-2024-27918 | CO Coder Coder | 8.2 | Mar 21 | Coder allows oragnizations to provision remote development environments via Terraform |
| CVE-2023-26114 | CO Code-server Coder | 9.3 | Mar 23 | Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes |
| CVE-2021-42648 | CO Code-server Coder | 6.1 | May 11 | Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL |
| CVE-2021-3810 | CO Code-server Coder | 7.5 | Sep 17 | code-server is vulnerable to Inefficient Regular Expression Complexity |