Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
0 CVE-2026-55085 is a critical cross-site scripting (XSS) vulnerability in Etherpad, a real-time collaborative editor. Versions prior to 3.3.1 improperly neutralize input when generating web pages, specifically by interpolating an unquoted 'start' attribute in ordered lists. This allows users with write access to inject malicious markup that executes when other users, including administrators, view the pad or its timeslider. The vulnerability is fixed in Etherpad version 3.3.1. Join the discussion | CVE Database V5 | 08/19/2026, 19:34:27 UTC Added: 08/19/2026, 19:52:51 UTC |
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0. Join the discussion | CVE Database V5 | 08/19/2026, 19:33:19 UTC Added: 08/19/2026, 19:52:54 UTC |
Showing 1 to 2 of 2 results