İçeriğe atla
Noroxi

coder kayıtları

coder üreticisine ait 28 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
2
Düzeltme kaydı olan
%100
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25
  6. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

28 kayıt
  • CVE-2023-26114
    37İzleyin

    Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.

    KritikCVSS 9,3İstismar yokEPSS %0

    coder · code-server23 Mar 2023

  • CVE-2026-44454
    36İzleyin

    Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

    YüksekCVSS 8,8İstismar yokEPSS %3

    coder · coder7 Tem 2026

  • CVE-2026-46354
    36İzleyin

    Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

    KritikCVSS 9,1İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2026-55429
    34İzleyin

    Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

    YüksekCVSS 8,7İstismar yokEPSS %1

    coder · coder7 Tem 2026

  • CVE-2026-35454
    34İzleyin

    Code Extension Marketplace has a Zip Slip Path Traversal

    YüksekCVSS 8,7İstismar yokEPSS %0

    coder · code-marketplace6 Nis 2026

  • CVE-2026-55427
    33İzleyin

    Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

    YüksekCVSS 8,3İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2024-27918
    32İzleyin

    Coder's OIDC authentication allows email with partially matching domain to register

    YüksekCVSS 8,2İstismar yokEPSS %1

    coder · coder20 Mar 2024

  • CVE-2026-55428
    32İzleyin

    Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

    YüksekCVSS 8,2İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2025-58437
    32İzleyin

    Coder's privilege escalation vulnerability could lead to a cross workspace compromise

    YüksekCVSS 8,1İstismar yokEPSS %0

    coder · coder5 Eyl 2025

  • CVE-2021-3810
    30İzleyin

    Inefficient Regular Expression Complexity in cdr/code-server

    YüksekCVSS 7,5İstismar yokEPSS %1

    coder · code-server17 Eyl 2021

  • CVE-2026-55076
    29İzleyin

    Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

    YüksekCVSS 7,4İstismar yokEPSS %1

    coder · coder7 Tem 2026

  • CVE-2026-55075
    29İzleyin

    Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

    YüksekCVSS 7,4İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2026-55436
    29İzleyin

    Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

    YüksekCVSS 7,4İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2026-55077
    28İzleyin

    Coder: User-admin role can reset owner account password

    YüksekCVSS 7,2İstismar yokEPSS %1

    coder · coder7 Tem 2026

  • CVE-2026-55438
    27İzleyin

    Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

    OrtaCVSS 6,8İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2026-55430
    27İzleyin

    Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

    OrtaCVSS 6,8İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2026-55079
    26İzleyin

    Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

    OrtaCVSS 6,5İstismar yokEPSS %1

    coder · coder7 Tem 2026

  • CVE-2026-55078
    26İzleyin

    Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

    OrtaCVSS 6,5İstismar yokEPSS %1

    coder · coder7 Tem 2026

  • CVE-2026-55434
    26İzleyin

    Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

    OrtaCVSS 6,5İstismar yokEPSS %1

    coder · coder7 Tem 2026

  • CVE-2026-45796
    26İzleyin

    Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

    OrtaCVSS 6,5İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2025-59956
    26İzleyin

    AgentAPI exposed user chat history via a DNS rebinding attack

    OrtaCVSS 6,5İstismar yokEPSS %0

    coder · agentapi30 Eyl 2025

  • CVE-2021-42648
    24İzleyin

    Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted U

    OrtaCVSS 6,1İstismar yokEPSS %1

    coder · code-server11 May 2022

  • CVE-2026-55431
    24İzleyin

    Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

    OrtaCVSS 6,1İstismar yokEPSS %0

    coder · coder7 Tem 2026

  • CVE-2025-66411
    22İzleyin

    Coder logged sensitive objects unsanitized

    OrtaCVSS 5,5İstismar yokEPSS %0

    coder · coder3 Ara 2025

  • CVE-2026-55433
    21İzleyin

    Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

    OrtaCVSS 5,4İstismar yokEPSS %0

    coder · coder7 Tem 2026