Ether vulnerabilities
We track 3 vulnerabilities in Ether products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 19, 2026.
Latest Ether vulnerabilities
- 9.9 Critical severity
etherpad: Incorrect Authorization
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the
- 9.6 Critical severity
etherpad: Improper Neutralization of Input During Web Page Generation
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML
- 8.6 High severity
Catalyst::Authentication::Credential::HTTP: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated f