Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge pro...

CVE-2026-55435

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and pr

历史摘要 · 未重新核验 · NVD

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

CVE-2026-55435

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and pr

历史摘要 · 未重新核验 · OSV.dev

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to...

CVE-2026-12352

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on t

历史摘要 · 未重新核验 · GitHub Advisory

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.

CVE-2026-12352

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on t

历史摘要 · 未重新核验 · NVD

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce ...

CVE-2026-34047

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Require Email Confirmation" setting is enabled, a logged-in c...

CVE-2026-53642

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Requ

历史摘要 · 未重新核验 · NVD

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by rea...

CVE-2026-32718

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

### Summary `agentConn.apiClient()` used the default redirect behavior of `http.Client` while its custom transport dial

历史摘要 · 未重新核验 · GitHub Advisory

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that t...

CVE-2026-54765

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gatewa

历史摘要 · 未重新核验 · NVD

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present ...

CVE-2026-42331

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/u

历史摘要 · 未重新核验 · NVD

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

CVE-2026-55435

### Summary AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validat

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

CVE-2026-55428

### Summary The tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applie

历史摘要 · 未重新核验 · GitHub Advisory

id: groups= computed from real GID instead of effective GID

CVE-2026-35370

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's rea

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of...

CVE-2026-14716

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function Meth

历史摘要 · 未重新核验 · NVD

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre...

CVE-2026-27780

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowin

历史摘要 · 未重新核验 · GitHub Advisory

Permanent Fork PR Workflow Approval Gate Bypass

CVE-2026-58424

Permanent Fork PR Workflow Approval Gate Bypass

历史摘要 · 未重新核验 · NVD

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

CVE-2026-28744

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repos

历史摘要 · 未重新核验 · NVD

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

CVE-2026-28740

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who h

历史摘要 · 未重新核验 · NVD

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

CVE-2026-28699

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic

历史摘要 · 未重新核验 · NVD

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

CVE-2026-27780

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowin

历史摘要 · 未重新核验 · NVD