CVE-2026-61791

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...

CVE-2026-61791 OCO-Server: Stored XSS through agent hostnames in command buttons

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...

CVE-2026-61791

Versions of OCO-Server prior to 1.2.1 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The Html::commandButton() function in lib/Html.class.php incorrectly handles stored computer hostnames by using htmlspecialchars(ENT_QUOTES) for HTML escaping only. Because browsers decode HTML entit...

EUVD-2026-108209

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...

CVE-2026-52742 GoCD is vulnerable to historical server configuration API authorization bypass

GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include...