Skip to content
OpenAdvisories

Vendor

ether

10 known vulnerabilities.

ether at a glance

Last 12 months
7
Critical · all time
4
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability, 1 critical Jun July 2026: 0 vulnerabilities August 2026: 6 vulnerabilities, 2 critical September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202662
Jul 202600
Jun 202611
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202500
May 202510
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

etherpad 6 Catalyst::Plugin::Authentication 1 etherpad-lite 1 FCGI 1 Catalyst::Authentication::Credential::HTTP 1
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Medium 4.2
    CVE-2026-55086

    Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

    Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary…

    ether etherpad ep_etherpad-lite npm
  • Critical 9.6
    CVE-2026-55085

    Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite

    Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTM…

    ether etherpad
  • Critical 9.9
    CVE-2026-55089

    Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint

    Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that th…

    ether etherpad
  • Medium 5.3
    CVE-2026-55090

    Etherpad: Stored XSS in HTML export via unescaped attribute-pool values

    Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor ca…

    ether etherpad ep_etherpad-lite npm
  • Medium 6.8
    CVE-2026-55088

    Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

    Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although…

    ether etherpad ep_etherpad-lite npm
  • Medium 6.1
    CVE-2026-55087

    Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

    Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization…

    ether etherpad ep_etherpad-lite npm
  • Critical 9.1
    CVE-2009-10007

    Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks

    Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can…

    ether Catalyst::Plugin::Authentication libcatalyst-plugin-authentication-perl libcatalyst-plugin-authentication-perl Debian Ubuntu
  • High 8.6
    CVE-2025-40920

    Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

    Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated …

    ether Catalyst::Authentication::Credential::HTTP libcatalyst-authentication-credential-http-perl libcatalyst-authentication-credential-http-perl Debian Ubuntu
  • Medium 5.3
    CVE-2025-40907

    FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

    FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nam…

    ether FCGI libfcgi-perl libfcgi-perl Debian Ubuntu
  • Critical 9.9
    CVE-2021-43802

    Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports

    Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a mal…

    ether etherpad-lite