CVE-2026-55438 | Medium | 5.8 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain… |
CVE-2026-55437 | Medium | 5.4 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine… |
CVE-2026-55436 | High | 7.4 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.3… |
CVE-2026-55433 | Medium | 5.4 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer r… |
CVE-2026-55432 | Medium | 5.4 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgen… |
CVE-2026-55431 | High | 7.7 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` o… |
CVE-2026-55430 | Medium | 5.8 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app… |
CVE-2026-55429 | High | 8.7 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceAp… |
CVE-2026-55428 | High | 8.2 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordi… |
CVE-2026-55427 | High | 8.3 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh`… |
CVE-2026-55079 | Medium | 4.9 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8… |
CVE-2026-55078 | Medium | 6.5 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8… |
CVE-2026-55077 | High | 7.2 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/u… |
CVE-2026-55076 | High | 7.4 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callb… |
CVE-2026-55075 | High | 7.4 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder… |
CVE-2026-46354 | Critical | 9.1 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33… |
CVE-2026-45796 | Medium | 6.5 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 a… |
CVE-2026-55434 | Medium | 6.5 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI B… |
CVE-2026-44454 | High | 8.1 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module pass… |
CVE-2026-55435 | Medium | 5.4 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.3… |
CVE-2026-35454 | Medium | 6.5 | 2026-04-06 | The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace. Prior to 2.4.2, Zip Slip vulnerability in coder/code-marketplace allow… |
CVE-2025-66411 | High | 7.8 | 2025-12-03 | Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containin… |
CVE-2025-59956 | Medium | 6.5 | 2025-09-30 | AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack w… |
CVE-2025-58437 | High | 8.1 | 2025-09-06 | Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be comp… |
CVE-2025-47269 | High | 8.3 | 2025-05-09 | code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result… |
CVE-2024-27918 | High | 8.2 | 2024-03-21 | Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OI… |
CVE-2023-26114 | High | 8.2 | 2023-03-23 | Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow… |
CVE-2021-42648 | Medium | 6.1 | 2022-05-11 | Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL. |
CVE-2021-3810 | High | 7.5 | 2021-09-17 | code-server is vulnerable to Inefficient Regular Expression Complexity |