1589 matches found
GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...
PT-2026-116500
Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.29.17 Coder versions 2.30.0 through 2.32.6 Coder versions 2.33.0 through 2.33.7 Coder versions 2.34.0 through 2.34.1 Description Stored HTML injection occurs because the ApplicationName and LogoURL appearance settings...
PT-2026-81999
Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...
PT-2026-83649
Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...
ANT-2026-5BD488PV · graphicsmagick · Stack-buffer-overflow
stack-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-5BD488PV: Stack-buffer-overflow in locale.c:257...
CLSA-2026-1786449735 Fix CVE(s): CVE-2025-43965, CVE-2025-66628, CVE-2026-24485
SECURITY UPDATE: TIM coder integer overflow on 32-bit - debian/patches/CVE-2025-66628.patch: bounds check in coders/tim.c - CVE-2025-66628 SECURITY UPDATE: PCD coder infinite loop on short read - debian/patches/CVE-2026-24485.patch: PCDGetBits guard in coders/pcd.c plus EOFBlob-based Sync-search ...
GO-2026-6000 vulnerabilities
Vulnerabilities for packages: datadog-operator, coder-fips, buildkite-agent-fips, datadog-agent-fips, vitess, traefik-fips, datadog-agent, datadog-operator-fips, kubernetes-dns-node-cache-fips, traefik, coder, eks-distro-fips, kubernetes-dns-node-cache, eks-distro, buildkite-agent...
Drupal Coder - coder_upgrade.run.php Exposure Detection
Soft-detects exposed Drupal Coder upgrade script at /sites/all/modules/coder/coderupgrade/scripts/coderupgrade.run.php. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Coder module coderupgrade.run.php exposure SA-CONTRIB-2016-039.""" from kittysploit import from lib.protocols.http.httpclient...
CVE-2026-19284
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
CVE-2026-19284 MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
CVE-2026-19284
MauricioMilano coder-api up to version 1.1.0 is affected by a local, command-injection vulnerability in the Projects Endpoint. The issue resides in the function createProject (src/core/projects.ts) and is triggered by input manipulation within that path. The attack is described as requiring local...
CVE-2026-19284 MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
EUVD-2026-54784
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
CVE-2026-19284
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
CVE-2026-19284: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
PT-2026-69197
Name of the Vulnerable Software and Affected Versions MauricioMilano coder-api versions prior to 1.1.1 Description Command injection is possible within the Projects Endpoint component. The issue resides in the createProject function located in the src/core/projects.ts file. This flaw allows a loc...
SUSE CVE-2026-45796
Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...
SUSE CVE-2026-55438
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the...