Skip to content
Ether vulnerabilities
Newest
-
ether etherpad
Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
CVE-2026-55085
9.6 Critical
-
ether etherpad
Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
CVE-2026-55089
9.9 Critical
-
ether etherpad
Etherpad: Stored XSS in HTML export via unescaped attribute-pool values
CVE-2026-55090
Fix available
5.3 Medium
-
ether etherpad
Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
CVE-2026-55088
Fix available
6.8 Medium
-
ether etherpad
Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
CVE-2026-55086
Fix available
4.2 Medium
-
ether etherpad
Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
CVE-2026-55087
Fix available
6.1 Medium
-
ether catalyst::plugin::authentication
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks
CVE-2009-10007
Fix available
9.1 Critical
-
ether catalyst::authentication::credential::http
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces
CVE-2025-40920
Fix available
8.6 High
-
ether fcgi
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library
CVE-2025-40907
Fix available
5.3 Medium
-
etherpad, ether etherpad-lite +1 more
Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports
CVE-2021-43802
9.9 Critical