EETHER

Products

Exploited and recent CVEs

• CVE-2026-55086 Medium 4.2 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite 0.1%
• CVE-2026-55085 Critical 9.6 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite 0.5%
• CVE-2026-55089 Critical 9.9 Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint 0.5%
• CVE-2026-55090 Medium 5.3 Etherpad: Stored XSS in HTML export via unescaped attribute-pool values 0.5%
• CVE-2026-55088 Medium 6.8 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token 0.4%
• CVE-2026-55087 Medium 6.1 Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect) 0.6%
• CVE-2025-40920 High 8.6 Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces 0.5%
• CVE-2025-40907 Medium 5.3 FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library 0.7%
• CVE-2021-43802 Critical 9.9 Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports 2.1%