Login Request a demo
CO
Product
coder
by coder · last CVE Oct 28, 2026
36
CVEs
0
On KEV
9.1
Max CVSS
12
New 30D
Vulnerabilities36In the news0Timeline
Severity mix
Critical 1High 12Medium 19Low 4
Severity
All severities36Critical1High12Medium19Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add coder to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44454
8.8
3%
Jul 7
Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
Affected: < 2.29.7; >= 2.30.0, < 2.30.2
CVE-2026-55429
8.7
1%
Jul 8
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17
CVE-2026-63443
8.3
1%
Sep 15
Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write
Affected: >= 2.27.0, < 2.29.19; >= 2.30.0, < 2.32.9; >= 2.33.0, < 2.33.10; >= 2.34.0, < 2.34.4
CVE-2026-55427
8.3
0%
Jul 7
Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17
CVE-2026-55428
8.2
0%
Jul 7
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17
CVE-2024-27918
8.2
1%
Mar 21
Coder allows oragnizations to provision remote development environments via Terraform
Affected: before 2.6.1; 2.7.0 before 2.7.3; 2.8.0 before 2.8.4
CVE-2025-58437
8.1
0%
Sep 6
Coder's privilege escalation vulnerability could lead to a cross workspace compromise
Affected: >= 2.22.0, < 2.24.4; >= 2.25.0, < 2.25.2
CVE-2026-111927
7.7
0%
Oct 17
Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match
Affected: 2.35.0 before 2.35.4; 2.34.0 before 2.34.8; 2.33.0 before 2.33.12; before 2.29.20
CVE-2026-55436
7.4
0%
Jul 8
Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7
CVE-2026-55076
7.4
1%
Jul 7
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17
CVE-2026-55075
7.4
0%
Jul 7
Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17
CVE-2026-55077
7.2
1%
Jul 7
Coder: User-admin role can reset owner account password
Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17
Showing 12