PkgSeer

Vulnerabilities

Last updated 38 minutes ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
github.com/coder/coder/v2 Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write High Risk 8.3 2 months ago 12 hours ago
github.com/coder/coder/v2 Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder Unknown 2 months ago 12 hours ago
github.com/coder/coder/v2 Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison Low Risk 3.7 26 days ago 6 days ago
github.com/coder/coder/v2 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings Low Risk 3.4 26 days ago 26 days ago
github.com/coder/coder/v2 Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints Medium Risk 6.5 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent High Risk 8.1 2 months ago 2 months ago
github.com/coder/coder/v2 Suspended Coder users retain access to AI Bridge LLM proxy endpoints Medium Risk 5.4 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps High Risk 7.7 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing Medium Risk 5.8 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component Medium Risk 5.4 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration High Risk 7.4 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service Medium Risk 6.5 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access Medium Risk 5.8 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's sub-agent app registration bypasses template port-sharing policy enforcement Medium Risk 5.4 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers Medium Risk 5.4 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID High Risk 8.7 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator High Risk 8.2 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass High Risk 7.4 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking High Risk 7.4 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service Medium Risk 4.9 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` High Risk 8.3 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: User-admin role can reset owner account password High Risk 7.2 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: User-admin role can reset owner account password in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft Critical 9.1 3 months ago 2 months ago
github.com/coder/coder/v2 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint Medium Risk 6.5 3 months ago 2 months ago
github.com/coder/coder/v2 Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder Unknown 2 months ago 2 months ago
github.com/coder/coder/v2 Coder logs sensitive objects unsanitized in github.com/coder/coder Unknown 9 months ago 6 months ago
github.com/coder/coder/v2 Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder Unknown 12 months ago 6 months ago
github.com/coder/coder/v2 Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder Unknown 1 year ago 6 months ago
github.com/coder/coder/v2 Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder Unknown 1 year ago 6 months ago
github.com/coder/coder/v2 Coder logs sensitive objects unsanitized High Risk 7.8 9 months ago 9 months ago
github.com/coder/coder/v2 Coder vulnerable to privilege escalation could lead to a cross workspace compromise High Risk 8.1 1 year ago 12 months ago
Data courtesy of OSV.dev
Page 1