[ Vendor · 11 CVEs ]
coder
CVEs affecting coder published in the last 30 days, plus any coder CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111931 | 17 Oct 2026 | CVSS 4.3 | coderCoder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally… | |
| CVE-2026-111932 | 17 Oct 2026 | CVSS 3.4 | coderCoder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the… | |
| CVE-2026-111933 | 17 Oct 2026 | CVSS 3.7 | coderCoder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because… | |
| CVE-2026-111934 | 17 Oct 2026 | CVSS 3.7 | coderCoder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied… | |
| CVE-2026-111926 | 17 Oct 2026 | CVSS 3.3 | coderCoder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent… | |
| CVE-2026-111927 | 17 Oct 2026 | CVSS 7.7 | coderCoder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in… | |
| CVE-2026-111928 | 17 Oct 2026 | CVSS 5.4 | coderCoder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not… | |
| CVE-2026-111929 | 17 Oct 2026 | CVSS 5.3 | coderCoder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows… | |
| CVE-2026-111930 | 17 Oct 2026 | CVSS 4.3 | coderCoder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace… | |
| CVE-2025-71435 | 17 Oct 2026 | CVSS 4.2 | coderCoder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when… | |
| CVE-2024-58398 | 17 Oct 2026 | CVSS 4.3 | coderCoder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the… |