schorschii OCO-Server

• CVE-2026-114611 Critical 9.1 OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack 0.3%
• CVE-2026-114515 Medium 6.5 OCO-Server: Self-Service Portal uninstall-job authorization bypass 0.3%
• CVE-2026-61791 High 7.4 OCO-Server: Stored XSS through agent hostnames in command buttons 0.3%