https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:06:08.219833+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2020-avi-465 certfr-2020-avi-465 — De multiples vulnérabilités ont été découvertes dans Zimbra. Elles permettent à un attaquant de provoquer un problème d… 2026-10-03T03:06:08.224773+00:00 certfr-2020-avi-465 https://cve.radiocsirt.org/vuln/cnvd-2019-23289 cnvd-2019-23289 2026-10-03T03:06:08.224827+00:00 cnvd-2019-23289 https://cve.radiocsirt.org/vuln/euvd-2026-60555 EUVD-2026-60555 2026-10-03T03:06:08.224842+00:00 EUVD-2026-60555 https://cve.radiocsirt.org/vuln/fkie_cve-2019-1010091 fkie_cve-2019-1010091 2026-10-03T03:06:08.224855+00:00

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.

 https://cve.radiocsirt.org/vuln/ghsa-c78w-2gw7-gjv3 GHSA-c78w-2gw7-gjv3 — XSS in TinyMCE 2026-10-03T03:06:08.224885+00:00

Affected: npm: tinymce

### Impact A cross-site scripting (XSS) vulnerability was discovered in: the core parser and `media` plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.9 or lower and TinyMCE 5.2.1 or lower.

### Patches This vulnerability has been patched in TinyMCE 4.9.10 and 5.2.2 by improved HTML parsing and sanitization logic.

### Workarounds The workarounds available are: - disable the media plugin and manually sanitize CDATA content (see below) or - upgrade to either TinyMCE 4.9.10 or TinyMCE 5.2.2

#### Example: Manually strip CDATA elements ```js setup: function(editor) { editor.on('PreInit', function() { editor.parser.addNodeFilter('#cdata', function(nodes) { for (var i = 0; i < nodes.length; i++) { nodes[i].remove(); } }); }); } ```

### Acknowledgements Tiny Technologies would like to thank Michał Bentkowski and [intivesec](https://github.com/intivesec) for discovering these vulnerabilities.

### References https://www.tiny.cloud/docs/release-notes/release-notes522/#securityfixes

### For more information If you have any questions or comments about this advisory: * Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues) * Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)

 https://cve.radiocsirt.org/vuln/gsd-2019-1010091 gsd-2019-1010091 2026-10-03T03:06:08.224925+00:00 gsd-2019-1010091 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-1010091 UBUNTU-CVE-2019-1010091 2026-10-03T03:06:08.224937+00:00

Affected: Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0790 WID-SEC-W-2023-0790 — IBM Maximo Asset Management: Mehrere Schwachstellen 2026-10-03T03:06:08.224959+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder einen Denial of Service Zustand herbeizuführen.