E
Vendor security profile
ether
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs6
Critical2
CISA KEV0
Public exploit4
Patch rate%67
Avg. CVSS7.0
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
6
0
0
CVE KEV
CVE severity distribution
6toplam CVE
Critical2 (33%)
Medium4 (67%)
Patch and exploitation view
%67
Verified patch
%0
CISA KEV
%67
Public exploit
4Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
4.2
CVE-2026-55086
Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
E
Patch verifiedEPSS %0
9.6
CVE-2026-55085
Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
E
Patch status unknownEPSS %0
9.9
CVE-2026-55089
Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
E
Patch status unknownEPSS %0
5.3
CVE-2026-55090
Etherpad: Stored XSS in HTML export via unescaped attribute-pool values
E
Patch verifiedEPSS %1
6.8
CVE-2026-55088
Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
E
Patch verifiedEPSS %0
6.1
CVE-2026-55087
Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
E
Patch verifiedEPSS %1
7.5
CVE-2022-23328
Uncontrolled resource consumption in Go Ethereum
E
Patch status unknownEPSS %1
7.5
CVE-2022-23327
Vulnerability in Go Ethereum
E
Patch status unknownEPSS %1