Ether - vulnerabilities (CVEs)
10 CVEs in 5 products, 0 in the last 30 days, newest from 2026-08-19.
Products
- Etherpad - 6 CVEs
- Catalystauthenticationcredentialhttp - 1 CVEs
- Catalystpluginauthentication - 1 CVEs
- Etherpad-lite - 1 CVEs
- Fcgi - 1 CVEs
Newest CVEs of Ether
- CVE-2026-55086 - CVSS 4.2 (medium), 2026-08-19: Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary…
- CVE-2026-55085 - CVSS 9.6 (critical), 2026-08-19: Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered…
- CVE-2026-55089 - CVSS 9.9 (critical), 2026-08-19: Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the…
- CVE-2026-55090 - CVSS 5.3 (medium), 2026-08-19: Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the…
- CVE-2026-55088 - CVSS 6.8 (medium), 2026-08-19: Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an…
- CVE-2026-55087 - CVSS 6.1 (medium), 2026-08-19: Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in…
- CVE-2009-10007 - CVSS 9.1 (critical), 2026-06-09: Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not…
- CVE-2025-40920 - CVSS 8.6 (high), 2025-08-11: Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a…
- CVE-2025-40907 - CVSS 5.3 (medium), 2025-05-16: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by…
- CVE-2021-43802 - CVSS 9.9 (critical), 2021-12-09: Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the…
