ETHER vulnerabilities
10 published CVEs name ETHER among the affected products.
- 10Published CVEs10 of them scored
- 7Last 12 monthspublished in the last year
- 4Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-55086
Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
ether · etherpad
Medium4.2 - CVE-2026-55085
Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
ether · etherpad
Critical9.6 - CVE-2026-55089
Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
ether · etherpad
Critical9.9 - CVE-2026-55090
Etherpad: Stored XSS in HTML export via unescaped attribute-pool values
ether · etherpad
Medium5.3 - CVE-2026-55088
Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
ether · etherpad
Medium6.8 - CVE-2026-55087
Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
ether · etherpad
Medium6.1 - CVE-2009-10007
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks
ETHER · Catalyst::Plugin::Authentication
Critical9.1 - CVE-2025-40920
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces
ETHER · Catalyst::Authentication::Credential::HTTP
High8.6 - CVE-2025-40907
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library
ETHER · FCGI
Medium5.3 - CVE-2021-43802
Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports
ether · etherpad-lite
Critical9.9