ETHER vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20252
3. 20267

Newest CVEs

• CVE-2026-55086

  Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

  ether · etherpad

  Medium4.2
• CVE-2026-55085

  Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite

  ether · etherpad

  Critical9.6
• CVE-2026-55089

  Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint

  ether · etherpad

  Critical9.9
• CVE-2026-55090

  Etherpad: Stored XSS in HTML export via unescaped attribute-pool values

  ether · etherpad

  Medium5.3
• CVE-2026-55088

  Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

  ether · etherpad

  Medium6.8
• CVE-2026-55087

  Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

  ether · etherpad

  Medium6.1
• CVE-2009-10007

  Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks

  ETHER · Catalyst::Plugin::Authentication

  Critical9.1
• CVE-2025-40920

  Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

  ETHER · Catalyst::Authentication::Credential::HTTP

  High8.6
• CVE-2025-40907

  FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

  ETHER · FCGI

  Medium5.3
• CVE-2021-43802

  Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports

  ether · etherpad-lite

  Critical9.9