coder vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20254
3. 202635

Newest CVEs

• CVE-2026-121967

  Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

  coder · coder

  Low2.3
• CVE-2026-118687

  Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication

  coder · coder

  High8.3
• CVE-2026-111934

  Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header

  coder · coder

  Medium6.3
• CVE-2026-111933

  Coder before 2.34.2 User Enumeration via Login Placeholder Hash

  coder · coder

  Medium6.3
• CVE-2026-111932

  Coder before 2.34.2 Stored HTML Injection via Appearance Settings

  coder · coder

  Medium4.8
• CVE-2026-111931

  Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy

  coder · coder

  Medium5.3
• CVE-2026-111930

  Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

  coder · coder

  Medium5.3
• CVE-2026-111929

  Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC

  coder · coder

  Medium6.0
• CVE-2026-111928

  Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy

  coder · coder

  Medium5.3
• CVE-2026-111927

  Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

  coder · coder

  High8.7