ETHER etherpad

• CVE-2026-55086 Medium 4.2 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite 0.1%
• CVE-2026-55085 Critical 9.6 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite 0.5%
• CVE-2026-55089 Critical 9.9 Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint 0.5%
• CVE-2026-55090 Medium 5.3 Etherpad: Stored XSS in HTML export via unescaped attribute-pool values 0.5%
• CVE-2026-55088 Medium 6.8 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token 0.4%
• CVE-2026-55087 Medium 6.1 Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect) 0.6%