{"items":[{"id":"CVE-2026-121967","published":"2026-11-04T15:33:28.808Z","updated":"2026-11-04T18:13:30.807Z","title":"Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal","severity":"LOW","score":2.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-118687","published":"2026-10-28T18:59:56.265Z","updated":"2026-10-29T20:54:16.473Z","title":"Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication","severity":"HIGH","score":8.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-111934","published":"2026-10-17T18:46:44.142Z","updated":"2026-10-19T16:39:17.593Z","title":"Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header","severity":"MEDIUM","score":6.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-111933","published":"2026-10-17T18:46:43.456Z","updated":"2026-10-19T15:12:57.230Z","title":"Coder before 2.34.2 User Enumeration via Login Placeholder Hash","severity":"MEDIUM","score":6.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-111932","published":"2026-10-17T18:46:42.757Z","updated":"2026-10-22T02:08:49.284Z","title":"Coder before 2.34.2 Stored HTML Injection via Appearance Settings","severity":"MEDIUM","score":4.8,"vendor":"coder","product":"coder","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-111931","published":"2026-10-17T18:46:42.064Z","updated":"2026-10-18T11:42:56.130Z","title":"Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy","severity":"MEDIUM","score":5.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-111930","published":"2026-10-17T18:46:41.399Z","updated":"2026-10-19T21:32:31.858Z","title":"Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint","severity":"MEDIUM","score":5.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-111929","published":"2026-10-17T18:46:40.707Z","updated":"2026-10-19T16:39:24.356Z","title":"Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC","severity":"MEDIUM","score":6,"vendor":"coder","product":"coder","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-111928","published":"2026-10-17T18:46:40.029Z","updated":"2026-10-19T15:03:05.568Z","title":"Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy","severity":"MEDIUM","score":5.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-111927","published":"2026-10-17T18:46:39.347Z","updated":"2026-10-21T21:45:39.027Z","title":"Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match","severity":"HIGH","score":8.7,"vendor":"coder","product":"coder","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-111926","published":"2026-10-17T18:46:38.631Z","updated":"2026-10-18T11:42:56.278Z","title":"Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest","severity":"MEDIUM","score":4.8,"vendor":"coder","product":"coder","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2025-71435","published":"2026-10-17T18:46:07.735Z","updated":"2026-10-19T14:40:10.199Z","title":"Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token","severity":"LOW","score":2.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2024-58398","published":"2026-10-17T18:46:07.073Z","updated":"2026-10-21T21:34:59.156Z","title":"Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter","severity":"MEDIUM","score":5.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-63443","published":"2026-09-15T16:44:23.048Z","updated":"2026-09-15T17:31:58.740Z","title":"Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write","severity":"HIGH","score":8.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2026-55438","published":"2026-07-08T00:31:20.573Z","updated":"2026-07-08T17:10:30.943Z","title":"Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing","severity":"MEDIUM","score":5.8,"vendor":"coder","product":"coder","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-55437","published":"2026-07-08T00:29:18.268Z","updated":"2026-07-08T14:00:43.204Z","title":"Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component","severity":"MEDIUM","score":5.4,"vendor":"coder","product":"coder","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-55436","published":"2026-07-08T00:26:13.175Z","updated":"2026-07-08T13:11:46.877Z","title":"Coder's AI Bridge Proxy skips TLS certificate verification in default configuration","severity":"HIGH","score":7.4,"vendor":"coder","product":"coder","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-55433","published":"2026-07-08T00:22:36.304Z","updated":"2026-07-08T13:01:44.431Z","title":"Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers","severity":"MEDIUM","score":5.4,"vendor":"coder","product":"coder","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-55432","published":"2026-07-08T00:20:24.264Z","updated":"2026-07-08T12:51:10.411Z","title":"Coder's sub-agent app registration bypasses template port-sharing policy enforcement","severity":"MEDIUM","score":5.4,"vendor":"coder","product":"coder","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-55431","published":"2026-07-08T00:10:49.165Z","updated":"2026-07-08T13:57:02.059Z","title":"Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps","severity":"HIGH","score":7.7,"vendor":"coder","product":"coder","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-55430","published":"2026-07-08T00:03:29.728Z","updated":"2026-07-08T17:10:40.949Z","title":"Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access","severity":"MEDIUM","score":5.8,"vendor":"coder","product":"coder","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-55429","published":"2026-07-08T00:00:33.785Z","updated":"2026-07-08T14:41:39.988Z","title":"Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID","severity":"HIGH","score":8.7,"vendor":"coder","product":"coder","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-55428","published":"2026-07-07T23:57:45.338Z","updated":"2026-07-08T13:11:08.435Z","title":"Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator","severity":"HIGH","score":8.2,"vendor":"coder","product":"coder","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-55427","published":"2026-07-07T23:55:26.240Z","updated":"2026-07-08T13:10:01.820Z","title":"Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`","severity":"HIGH","score":8.3,"vendor":"coder","product":"coder","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2026-55079","published":"2026-07-07T23:50:37.197Z","updated":"2026-07-08T12:53:41.432Z","title":"Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service","severity":"MEDIUM","score":4.9,"vendor":"coder","product":"coder","kev":false,"epss":0.00611,"kevAdded":null},{"id":"CVE-2026-55078","published":"2026-07-07T22:47:07.079Z","updated":"2026-07-08T13:55:16.017Z","title":"Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service","severity":"MEDIUM","score":6.5,"vendor":"coder","product":"coder","kev":false,"epss":0.00602,"kevAdded":null},{"id":"CVE-2026-55077","published":"2026-07-07T22:44:28.621Z","updated":"2026-07-09T14:41:52.486Z","title":"Coder: User-admin role can reset owner account password","severity":"HIGH","score":7.2,"vendor":"coder","product":"coder","kev":false,"epss":0.00615,"kevAdded":null},{"id":"CVE-2026-55076","published":"2026-07-07T22:23:26.179Z","updated":"2026-07-08T14:03:39.329Z","title":"Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking","severity":"HIGH","score":7.4,"vendor":"coder","product":"coder","kev":false,"epss":0.0061,"kevAdded":null},{"id":"CVE-2026-55075","published":"2026-07-07T21:33:38.189Z","updated":"2026-07-08T13:03:16.212Z","title":"Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass","severity":"HIGH","score":7.4,"vendor":"coder","product":"coder","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-46354","published":"2026-07-07T21:10:01.899Z","updated":"2026-07-08T13:01:25.192Z","title":"Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft","severity":"CRITICAL","score":9.1,"vendor":"coder","product":"coder","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-45796","published":"2026-07-07T21:03:11.066Z","updated":"2026-07-08T13:53:41.602Z","title":"Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint","severity":"MEDIUM","score":6.5,"vendor":"coder","product":"coder","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-44454","published":"2026-07-07T20:16:39.161Z","updated":"2026-07-08T13:48:00.841Z","title":"Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent","severity":"HIGH","score":8.1,"vendor":"coder","product":"coder","kev":false,"epss":0.02642,"kevAdded":null},{"id":"CVE-2026-55434","published":"2026-07-07T20:14:00.531Z","updated":"2026-07-08T14:15:15.446Z","title":"Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints","severity":"MEDIUM","score":6.5,"vendor":"coder","product":"coder","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-55435","published":"2026-07-07T17:37:31.211Z","updated":"2026-07-09T14:42:41.115Z","title":"Suspended Coder users retain access to AI Bridge LLM proxy endpoints","severity":"MEDIUM","score":5.4,"vendor":"coder","product":"coder","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-35454","published":"2026-04-06T21:51:53.048Z","updated":"2026-04-07T15:08:45.865Z","title":"Code Extension Marketplace has a Zip Slip Path Traversal","severity":"HIGH","score":8.7,"vendor":"coder","product":"code-marketplace","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2025-66411","published":"2025-12-03T19:25:24.207Z","updated":"2025-12-03T21:42:17.349Z","title":"Coder logged sensitive objects unsanitized","severity":"HIGH","score":7.8,"vendor":"coder","product":"coder","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2025-59956","published":"2025-09-29T23:57:08.133Z","updated":"2025-09-30T14:14:53.214Z","title":"AgentAPI exposed user chat history via a DNS rebinding attack","severity":"MEDIUM","score":6.5,"vendor":"coder","product":"agentapi","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2025-58437","published":"2025-09-06T02:30:08.378Z","updated":"2025-09-08T16:45:15.915Z","title":"Coder's privilege escalation vulnerability could lead to a cross workspace compromise","severity":"HIGH","score":8.1,"vendor":"coder","product":"coder","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2025-47269","published":"2025-05-09T20:59:01.510Z","updated":"2025-05-10T01:45:13.443Z","title":"code-server session cookie can be extracted by having user visit specially crafted proxy URL","severity":"HIGH","score":8.3,"vendor":"coder","product":"code-server","kev":false,"epss":0.56284,"kevAdded":null},{"id":"CVE-2024-27918","published":"2024-03-06T20:25:24.601Z","updated":"2024-08-05T18:06:33.208Z","title":"Coder's OIDC authentication allows email with partially matching domain to register","severity":"HIGH","score":8.2,"vendor":"coder","product":"coder","kev":false,"epss":0.00965,"kevAdded":null}]}