CVE-2025-66208 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy

Collabora Online - Built-in CODE Server richdocumentscode provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE OS Command Injection in richdocumentscode proxy. Users of Nextclou...

CVE-2025-66208

CVE-2025-66208 affects Collabora Online – Built-in CODE Server (richdocumentscode proxy). The vulnerability is a configuration-dependent OS command injection (RCE) in the richdocumentscode proxy present in versions prior to 25.04.702, exploitable by attackers via proxy.php and an intermediate rev...

CVE-2025-66208 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy

Collabora Online - Built-in CODE Server richdocumentscode provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE OS Command Injection in richdocumentscode proxy. Users of Nextclou...

GHSA-MH29-5H37-FV8M vulnerabilities

Vulnerabilities for packages: kubeflow-katib, eslint, jitsucom-jitsu, pulumi, renovate, saf, opensearch-dashboards, tileserver-gl, ts-patch, py3-jupyterlab, prism, sqlpad, code-server, lerna, vitess, thingsboard, kubeflow-pipelines, argo-workflows...

CVE-2025-64718 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, eslint, jitsucom-jitsu, pulumi, renovate, saf, opensearch-dashboards, tileserver-gl, ts-patch, py3-jupyterlab, prism, sqlpad, code-server, lerna, vitess, thingsboard, kubeflow-pipelines, argo-workflows...

GHSA-MH29-5H37-FV8M vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, jitsucom-jitsu, thingsboard, eslint, kubeflow-katib, tensorflow-cpu-jupyter, renovate, tileserver-gl, lerna, kubeflow-pipelines, wazuh-dashboard-fips, drupal, gitlab-rails-ce-fips, ts-patch, opensearch-dashboards, argo-workflows, kibana, awx,...

CVE-2025-64718 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, jitsucom-jitsu, thingsboard, eslint, kubeflow-katib, tensorflow-cpu-jupyter, renovate, tileserver-gl, lerna, kubeflow-pipelines, wazuh-dashboard-fips, drupal, gitlab-rails-ce-fips, ts-patch, opensearch-dashboards, argo-workflows, kibana, awx,...

EUVD-2021-1971

Malware in sbrugna...

EUVD-2022-1985

Malicious code in bioql PyPI...

EUVD-2023-52370

Malicious code in bioql PyPI...

EUVD-2023-1003

Malicious code in bioql PyPI...

EUVD-2025-14189

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2018-1000875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutabl...

CVE-2023-26114

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance...

CVE-2021-3810

code-server is vulnerable to Inefficient Regular Expression Complexity...

CVE-2025-47279 vulnerabilities

Vulnerabilities for packages: code-server...

GHSA-CXRH-J4JR-QWG3 vulnerabilities

Vulnerabilities for packages: code-server...

CVE-2025-47279 vulnerabilities

Vulnerabilities for packages: code-server...

GHSA-CXRH-J4JR-QWG3 vulnerabilities

Vulnerabilities for packages: code-server...

Session Hijacking

code-server is vulnerable to session hijacking. The vulnerability is due to insufficient validation of proxy request URLs, specifically the failure to properly validate the port and domain in requests using the /proxy subpath, allows attackers to redirect traffic—including session cookies—to...