netfoil has a resource leak in LRU cache

### Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up.

历史摘要 · 未重新核验 · GitHub Advisory

netfoil has a domain name filter bypass via multiple questions

### Summary Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first que

历史摘要 · 未重新核验 · GitHub Advisory

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

### Summary `agentConn.apiClient()` used the default redirect behavior of `http.Client` while its custom transport dial

历史摘要 · 未重新核验 · GitHub Advisory

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

CVE-2026-55438

### Summary Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a worksp

历史摘要 · 未重新核验 · GitHub Advisory

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

CVE-2026-55437

### Summary The `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted t

历史摘要 · 未重新核验 · GitHub Advisory

Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

CVE-2026-55436

### Summary The AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVe

历史摘要 · 未重新核验 · GitHub Advisory

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

CVE-2026-55435

### Summary AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validat

历史摘要 · 未重新核验 · GitHub Advisory

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

CVE-2026-55434

### Summary AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticate

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

CVE-2026-55433

### Summary The devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspa

历史摘要 · 未重新核验 · GitHub Advisory

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

CVE-2026-55432

### Summary The `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortShar

历史摘要 · 未重新核验 · GitHub Advisory

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

CVE-2026-55431

### Summary `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

CVE-2026-55078

### Summary `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-ent

历史摘要 · 未重新核验 · GitHub Advisory

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

CVE-2026-55430

### Summary The workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

CVE-2026-55428

### Summary The tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applie

历史摘要 · 未重新核验 · GitHub Advisory

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

CVE-2026-55429

### Summary `UpsertWorkspaceApp` overwrites an existing app's `agent_id` on a primary-key conflict and `insertAgentApp`

历史摘要 · 未重新核验 · GitHub Advisory

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

CVE-2026-55079

### Summary `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `

历史摘要 · 未重新核验 · GitHub Advisory

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

CVE-2026-55427

### Summary `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user'

历史摘要 · 未重新核验 · GitHub Advisory

Coder: User-admin role can reset owner account password

CVE-2026-55077

### Summary The `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent

历史摘要 · 未重新核验 · GitHub Advisory

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

CVE-2026-55075

### Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linki

历史摘要 · 未重新核验 · GitHub Advisory

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

CVE-2026-55076

### Summary Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned

历史摘要 · 未重新核验 · GitHub Advisory