https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:26:10.727044+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-41424 EUVD-2026-41424 2026-10-04T08:26:10.730837+00:00 EUVD-2026-41424 https://cve.radiocsirt.org/vuln/fkie_cve-2020-12648 fkie_cve-2020-12648 2026-10-04T08:26:10.730868+00:00

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.

 https://cve.radiocsirt.org/vuln/ghsa-vrv8-v4w8-f95h GHSA-vrv8-v4w8-f95h — Cross-site scripting vulnerability in TinyMCE 2026-10-04T08:26:10.730897+00:00

Affected: npm: tinymce

### Impact A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.

### Patches This vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.

### Workarounds The workarounds available are: - upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1 or - enable the media plugin, which overrides the default parsing behaviour for iframes or - add the following workaround to update the parsing schema rules for iframes:

#### Example: Change the default schema for iframes ```js setup: function(editor) { editor.on('PreInit', function() { editor.schema.getSpecialElements()['iframe'] = /</iframe[^>]*>/gi; }); } ```

### Acknowledgements Tiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.

### References https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes

### For more information If you have any questions or comments about this advisory: * Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues) * Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)

 https://cve.radiocsirt.org/vuln/gsd-2020-12648 gsd-2020-12648 2026-10-04T08:26:10.730935+00:00 gsd-2020-12648 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-12648 UBUNTU-CVE-2020-12648 2026-10-04T08:26:10.730949+00:00

Affected: Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.