CVE-2026-53218 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-37PV-M98R-VGM8 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

CVE-2026-53223 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-3J9Q-258H-4V38 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-3P7H-6F7M-PV53 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-7Q5M-QV9W-C8XX vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-5Q2P-7748-G6QP vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-9MPH-4HQC-XQX7 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-GV3C-2GHH-53G2 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-GVRM-XH5G-W8V6 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-WFX4-V2WF-4GMP vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-HHXP-R7J7-V7JV vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-PW9R-H2M6-6VVG vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

GHSA-FJ73-9FR6-G7MW vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp, linux-aws, linux-qemu-melange...

CVE-2026-45796

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...

CVE-2026-46354

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature...

CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature...

CVE-2026-46354

Summary: A PKCS#7 signature bypass in Coder (Coder v2 before patches) allows unauthenticated token theft via Azure instance identity. The issue stems from azureidentity.Validate() validating only the signer certificate chain, not the signature itself, enabling forged PKCS#7 envelopes containing a...

CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature...

CVE-2026-45796 Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...