These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-55090 is a medium-severity vulnerability in Etherpad, a real-time collaborative editor. The issue arises from inadequate HTML attribute escaping in the getHTMLFromAtext function, which allows for cross-site scripting (XSS) attacks via HTML exports. An attacker can exploit this by manipulating the exportHtmlAdditionalTagsWithData plugin hook to inject malicious values into span data attributes. Th [truncated]
CVE-2026-55089 is a critical vulnerability in Etherpad, a real-time collaborative editor, affecting versions from 2.1.0 to 3.1.0. The issue allows non-admin users with valid signed tokens to invoke administrative functions, potentially leading to disclosure, modification, or deletion of pads across the instance. This vulnerability is fixed in version 3.1.0.
Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenDa [truncated]
Etherpad is vulnerable to cross-site scripting (XSS) attacks due to improper sanitization of the x-proxy-path request header in versions from 2.1.0 to 3.0.0. This allows an attacker to inject malicious scripts into HTML, JavaScript, and CSS under the /admin path. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. The issue is exploitable when cli [truncated]
Etherpad, a real-time collaborative editor, had a vulnerability prior to version 3.1.0 where temporary filenames were derived from Math.random() and placed in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker could predict a filename and precreate a symbolic link to a file writable by the Etherpad process. This could lead to overwriting of the target fi [truncated]
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, in [truncated]
CVE-2009-10007 is a critical vulnerability in Catalyst::Plugin::Authentication versions before 0.10_027 for Perl. The plugin does not automatically change the session id after authentication, making it susceptible to session fixation attacks. An attacker who obtains a session id cookie can use this to impersonate the victim.