schorschii has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.4 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-114611Critical· 9.1OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack50CVE-2026-61791High· 7.4OCO-Server: Stored XSS through agent hostnames in command buttons41CVE-2026-114515Medium· 6.5OCO-Server: Self-Service Portal uninstall-job authorization bypass36
schorschii vulnerabilities
CVEs affecting schorschii, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-114611Critical· 9.1OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment…
CVE-2026-114515Medium· 6.5OCO-Server: Self-Service Portal uninstall-job authorization bypass
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read vis…
CVE-2026-61791High· 7.4OCO-Server: Stored XSS through agent hostnames in command buttons
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stor…