https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:20:48.516074+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-05267 bdu:2023-05267 2026-10-03T18:20:48.631818+00:00 bdu:2023-05267 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0992 certfr-2024-avi-0992 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T18:20:48.631853+00:00 certfr-2024-avi-0992 https://cve.radiocsirt.org/vuln/euvd-2026-216385 EUVD-2026-216385 2026-10-03T18:20:48.631872+00:00 EUVD-2026-216385 https://cve.radiocsirt.org/vuln/fkie_cve-2023-28439 fkie_cve-2023-28439 2026-10-03T18:20:48.631883+00:00

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism.

A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.

 https://cve.radiocsirt.org/vuln/gsd-2023-28439 gsd-2023-28439 2026-10-03T18:20:48.631922+00:00 gsd-2023-28439 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-28439 UBUNTU-CVE-2023-28439 2026-10-03T18:20:48.631933+00:00

Affected: Ubuntu:Pro:16.04:LTS: ckeditor, Ubuntu:16.04:LTS: ldap-account-manager, Ubuntu:16.04:LTS: request-tracker4, Ubuntu:Pro:18.04:LTS: ckeditor, Ubuntu:18.04:LTS: ckeditor3, Ubuntu:18.04:LTS: ldap-account-manager, Ubuntu:Pro:18.04:LTS: request-tracker4, Ubuntu:Pro:20.04:LTS: ckeditor, Ubuntu:20.04:LTS: ckeditor3, Ubuntu:20.04:LTS: ldap-account-manager and 12 more

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1783 WID-SEC-W-2023-1783 — Oracle Supply Chain: Mehrere Schwachstellen 2026-10-03T18:20:48.631993+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.