https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:41:14.089501+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/drupal-contrib-2024-009 DRUPAL-CONTRIB-2024-009 2026-10-03T12:41:14.092847+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/ckeditor_lts

The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a [security update](https://ckeditor.com/cke4/release/CKEditor-4.24.0-LTS) that on certain configurations may impact the Drupal module that bundles and integrates this code.

The vulnerability is mitigated by the fact it requires:

1. [full-page editing](https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) mode is enabled 2. or CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements) are enabled. 3. An attacker must have a permission with access to the CKEditor instance.

For more information, see CKEditor's security advisory: [CVE-2024-24815](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm): Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection

 https://cve.radiocsirt.org/vuln/euvd-2026-209914 EUVD-2026-209914 2026-10-03T12:41:14.092920+00:00 EUVD-2026-209914 https://cve.radiocsirt.org/vuln/fkie_cve-2024-13245 fkie_cve-2024-13245 2026-10-03T12:41:14.092939+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.

 https://cve.radiocsirt.org/vuln/ghsa-2gj6-558v-rq2w GHSA-2gj6-558v-rq2w 2026-10-03T12:41:14.092962+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0400 WID-SEC-W-2024-0400 — Drupal: Schwachstelle ermöglicht Cross-Site Scripting 2026-10-03T12:41:14.092976+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.