GHSA-MH29-5H37-FV8M vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse, lerna, prism, eslint, saf, kubeflow-pipelines, thingsboard, tileserver-gl, pulumi, vitess, argo-workflows, renovate, code-server, opensearch-dashboards...

CVE-2025-64718 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse, lerna, prism, eslint, saf, kubeflow-pipelines, thingsboard, tileserver-gl, pulumi, vitess, argo-workflows, renovate, code-server, opensearch-dashboards...

CVE-2025-64718 vulnerabilities

Vulnerabilities for packages: pulumi, saf, redisinsight, librechat, kubeflow-pipelines, eslint, vitess, opensearch-dashboards, kibana, thingsboard, prism, tileserver-gl, opensearch-dashboards-fips, argo-workflows, lerna, tileserver-gl-fips, renovate, code-server, langfuse, arangodb, jitsucom-jits...

GHSA-MH29-5H37-FV8M vulnerabilities

Vulnerabilities for packages: pulumi, saf, redisinsight, librechat, kubeflow-pipelines, eslint, vitess, opensearch-dashboards, kibana, thingsboard, prism, tileserver-gl, opensearch-dashboards-fips, argo-workflows, lerna, tileserver-gl-fips, renovate, code-server, langfuse, arangodb, jitsucom-jits...

EUVD-2021-1971

Malware in sbrugna...

EUVD-2023-52370

Malicious code in bioql PyPI...

EUVD-2023-1003

Malicious code in bioql PyPI...

EUVD-2022-1985

Malicious code in bioql PyPI...

EUVD-2025-14189

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2018-1000875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutabl...

CVE-2023-26114

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance...

CVE-2021-3810

code-server is vulnerable to Inefficient Regular Expression Complexity...

CVE-2025-47279 vulnerabilities

Vulnerabilities for packages: code-server...

GHSA-CXRH-J4JR-QWG3 vulnerabilities

Vulnerabilities for packages: code-server...

CVE-2025-47279 vulnerabilities

Vulnerabilities for packages: code-server...

GHSA-CXRH-J4JR-QWG3 vulnerabilities

Vulnerabilities for packages: code-server...

Session Hijacking

code-server is vulnerable to session hijacking. The vulnerability is due to insufficient validation of proxy request URLs, specifically the failure to properly validate the port and domain in requests using the /proxy subpath, allows attackers to redirect traffic—including session cookies—to...

CVE-2025-47269

code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to a...

CVE-2025-47269

code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to a...

CVE-2025-47269 code-server session cookie can be extracted by having user visit specially crafted proxy URL

code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to a...