https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T06:57:24.972817+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-159509 EUVD-2026-159509 2026-10-05T06:57:25.049210+00:00 EUVD-2026-159509 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43411 fkie_cve-2024-43411 2026-10-05T06:57:25.049249+00:00

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.

 https://cve.radiocsirt.org/vuln/ghsa-6v96-m24v-f58j GHSA-6v96-m24v-f58j — CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover 2026-10-05T06:57:25.049294+00:00

Affected: npm: ckeditor4

### Affected Packages

The issue impacts only editor instances with enabled [version notifications](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-versionCheck).

Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please [contact us](mailto:security@cksource.com).

### Impact

A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. Although the vulnerability is purely hypothetical, we have addressed it in CKEditor 4.25.0-lts to ensure compliance with security best practices.

### Patches

The issue has been recognized and patched. The fix is available in version 4.25.0-lts.

### For More Information

If you have any questions or comments about this advisory, please email us at [security@cksource.com](mailto:security@cksource.com).

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43411 UBUNTU-CVE-2024-43411 2026-10-05T06:57:25.049335+00:00

Affected: Ubuntu:16.04:LTS: ldap-account-manager, Ubuntu:16.04:LTS: request-tracker4, Ubuntu:18.04:LTS: ckeditor3, Ubuntu:18.04:LTS: ldap-account-manager, Ubuntu:Pro:18.04:LTS: request-tracker4, Ubuntu:20.04:LTS: ckeditor3, Ubuntu:20.04:LTS: ldap-account-manager, Ubuntu:20.04:LTS: request-tracker4, Ubuntu:22.04:LTS: ckeditor3, Ubuntu:22.04:LTS: ldap-account-manager and 10 more

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.