CVE Tools
Track your stack

Coder

31 CVEs tracked since 2026. Since Jul 2026, none of them reached CISA KEV.

Coder CVEs per month

Jul 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Coder CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-07200
2026-088 or fewer
2026-099 or fewer
2026-10110

Products

The products that kept showing up in Coder's monthly top three, with their CVEs summed over those months.

  1. Coder312 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Coder.

  1. CVE-2026-118687Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication6.5
  2. CVE-2026-111934Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header3.7
  3. CVE-2026-111933Coder before 2.34.2 User Enumeration via Login Placeholder Hash3.7
  4. CVE-2026-111932Coder before 2.34.2 Stored HTML Injection via Appearance Settings3.4
  5. CVE-2026-111931Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy4.3
  6. CVE-2026-111930Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint4.3
  7. CVE-2026-111928Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy5.4
  8. CVE-2026-111929Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC5.3
  9. CVE-2026-111927Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match7.7
  10. CVE-2026-111926Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest3.3
  11. CVE-2025-71435Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token4.2
  12. CVE-2024-58398Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter4.3
  13. CVE-2026-63443Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write8.3
  14. CVE-2026-55438Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing5.8
  15. CVE-2026-55437Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component5.4

The record

Peak rank
#56 in Jul 2026
Busiest month shown
Jul 2026, 20 CVEs
Months with a KEV entry
0 since Jul 2026
Monthly snapshots
2 since 2026
Coder's full record, month by month