Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,167All CVEsplus 19,120 rejected
- 475Last 24 hours2,787 in the last 7 days
- 16,855Last 30 days1,538 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 13 | 19 | 2 | 0 | 35 | 40 |
| 2025 | 0 | 3 | 1 | 0 | 0 | 4 | 5 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-121967 | Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversalcoder · coder | Low2.3 |
| CVE-2026-118687 | Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authenticationcoder · coder | High8.3 |
| CVE-2026-111934 | Coder before 2.34.7 IP Spoofing via X-Forwarded-For Headercoder · coder | Medium6.3 |
| CVE-2026-111933 | Coder before 2.34.2 User Enumeration via Login Placeholder Hashcoder · coder | Medium6.3 |
| CVE-2026-111932 | Coder before 2.34.2 Stored HTML Injection via Appearance Settingscoder · coder | Medium4.8 |
| CVE-2026-111931 | Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxycoder · coder | Medium5.3 |
| CVE-2026-111930 | Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpointcoder · coder | Medium5.3 |
| CVE-2026-111929 | Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPCcoder · coder | Medium6.0 |
| CVE-2026-111928 | Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policycoder · coder | Medium5.3 |
| CVE-2026-111927 | Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Matchcoder · coder | High8.7 |
| CVE-2026-111926 | Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifestcoder · coder | Medium4.8 |
| CVE-2025-71435 | Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Tokencoder · coder | Low2.3 |
| CVE-2024-58398 | Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parametercoder · coder | Medium5.3 |
| CVE-2026-63443 | Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and writecoder · coder | High8.3 |
| CVE-2026-55438 | Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingcoder · coder | Medium5.8 |
| CVE-2026-55437 | Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine componentcoder · coder | Medium5.4 |
| CVE-2026-55436 | Coder's AI Bridge Proxy skips TLS certificate verification in default configurationcoder · coder | High7.4 |
| CVE-2026-55433 | Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containerscoder · coder | Medium5.4 |
| CVE-2026-55432 | Coder's sub-agent app registration bypasses template port-sharing policy enforcementcoder · coder | Medium5.4 |
| CVE-2026-55431 | Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace appscoder · coder | High7.7 |
| CVE-2026-55430 | Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accesscoder · coder | Medium5.8 |
| CVE-2026-55429 | Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app IDcoder · coder | High8.7 |
| CVE-2026-55428 | Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinatorcoder · coder | High8.2 |
| CVE-2026-55427 | Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`coder · coder | High8.3 |
| CVE-2026-55079 | Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of servicecoder · coder | Medium4.9 |
| CVE-2026-55078 | Coder: Zip upload decompression lacks aggregate size limit, enabling denial of servicecoder · coder | Medium6.5 |
| CVE-2026-55077 | Coder: User-admin role can reset owner account passwordcoder · coder | High7.2 |
| CVE-2026-55076 | Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linkingcoder · coder | High7.4 |
| CVE-2026-55075 | Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypasscoder · coder | High7.4 |
| CVE-2026-46354 | Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theftcoder · coder | Critical9.1 |
| CVE-2026-45796 | Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpointcoder · coder | Medium6.5 |
| CVE-2026-44454 | Coder vulnerable to workspace auto-creation via crafted URL parameters without user consentcoder · coder | High8.1 |
| CVE-2026-55434 | Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpointscoder · coder | Medium6.5 |
| CVE-2026-55435 | Suspended Coder users retain access to AI Bridge LLM proxy endpointscoder · coder | Medium5.4 |
| CVE-2026-35454 | Code Extension Marketplace has a Zip Slip Path Traversalcoder · code-marketplace | High8.7 |
| CVE-2025-66411 | Coder logged sensitive objects unsanitizedcoder · coder | High7.8 |
| CVE-2025-59956 | AgentAPI exposed user chat history via a DNS rebinding attackcoder · agentapi | Medium6.5 |
| CVE-2025-58437 | Coder's privilege escalation vulnerability could lead to a cross workspace compromisecoder · coder | High8.1 |
| CVE-2025-47269 | code-server session cookie can be extracted by having user visit specially crafted proxy URLcoder · code-server | High8.3 |
| CVE-2024-27918 | Coder's OIDC authentication allows email with partially matching domain to registercoder · coder | High8.2 |