CVE-2026-114515 is an authorization bypass vulnerability in OCO-Server's Self-Service Portal. A user with create job containers and read visibility permissions can queue an uninstall job without deploy permission, affecting OCO-Server versions prior to 1.2.3. The vulnerability allows for potential unauthorized uninstallation of packages and possible elevation of privileges for affected users. Defenders sh [truncated]
CVE-2026-61791: OCO-Server Stored XSS through agent hostnames in command buttons. The vulnerability allows an attacker to execute script in an administrator's authenticated session. Defenders should assess exposure and verify version 1.2.1 or later usage, particularly for instances with self-registration enabled. The vulnerability is caused by improper HTML escaping in the `Html::commandButton()` function [truncated]
