Login Request a demo
CO
Product
code-server
by coder · last CVE May 9, 2025
4
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 1High 2Medium 1Low 0
Severity
All severities4Critical1High2Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add code-server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-26114
9.3
0%
Mar 23
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes
Affected: before 4.10.1
CVE-2025-47269
8.3
45%
May 9
code-server session cookie can be extracted by having user visit specially crafted proxy URL
Affected: < 4.99.4
CVE-2021-3810
7.5
1%
Sep 17
code-server is vulnerable to Inefficient Regular Expression Complexity
Affected: before 3.12.0
CVE-2021-42648
6.1
1%
May 11
Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL
Affected: before 3.12.0
Showing 4