https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:54:02.427942+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-324014 EUVD-2026-324014 2026-10-03T11:54:02.492439+00:00 EUVD-2026-324014 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47760 fkie_cve-2026-47760 2026-10-03T11:54:02.492478+00:00

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-mh5m-5hw4-5c69 GHSA-mh5m-5hw4-5c69 — TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs 2026-10-03T11:54:02.492514+00:00

Affected: npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce

### Impact TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested <svg> elements can bypass attribute sanitization and execute arbitrary JavaScript.

### Patches This issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later.

### Workarounds No official workaround available.

### Acknowledgements Tiny thanks [maple3142](https://github.com/maple3142) (<https://maple3142.net>) of DEVCORE for their help identifying this vulnerability.

### References Fix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-47760 UBUNTU-CVE-2026-47760 2026-10-03T11:54:02.492550+00:00

Affected: Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.