https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:49:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337114 EUVD-2026-337114 https://cve.radiocsirt.org/vuln/euvd-2026-337114 https://cve.radiocsirt.org/vuln/fkie_cve-2024-21908 <p>TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user&#39;s browser.</p> <p>TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user&#39;s browser.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-21908 https://cve.radiocsirt.org/vuln/ghsa-5h9g-x5rv-25wg <p><strong>Affected:</strong> npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce</p> <p>### Impact A cross-site scripting (XSS) vulnerability was discovered in the schema validation logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or editor APIs. This malicious content could then end up in content published outside the editor, if no server-side sanitization was performed. This impacts all users who are using TinyMCE 5.8.2 or lower.</p> <p>### Patches This vulnerability has been patched in TinyMCE 5.9.0 by ensuring schema validation was still performed after unwrapping invalid elements.</p> <p>### Workarounds To work around this vulnerability, either: - Upgrade to TinyMCE 5.9.0 or higher - Manually sanitize the content using the `BeforeSetContent` event (see below)</p> <p>#### Example: Manually sanitize content ```js editor.on(&#39;BeforeSetContent&#39;, function(e) { var sanitizedContent = ...; // Manually sanitize content here e.content = sanitizedContent; }); ```</p> <p>### Acknowledgements Tiny Technologies would like to thank William Bowling for discovering this vulnerability.</p> <p>### References https://www.tiny.cloud/docs/release-notes/release-notes59/#securityfixes</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud) * Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)</p> <p><strong>Affected:</strong> npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce</p> <p>### Impact A cross-site scripting (XSS) vulnerability was discovered in the schema validation logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or editor APIs. This malicious content could then end up in content published outside the editor, if no server-side sanitization was performed. This impacts all users who are using TinyMCE 5.8.2 or lower.</p> <p>### Patches This vulnerability has been patched in TinyMCE 5.9.0 by ensuring schema validation was still performed after unwrapping invalid elements.</p> <p>### Workarounds To work around this vulnerability, either: - Upgrade to TinyMCE 5.9.0 or higher - Manually sanitize the content using the `BeforeSetContent` event (see below)</p> <p>#### Example: Manually sanitize content ```js editor.on(&#39;BeforeSetContent&#39;, function(e) { var sanitizedContent = ...; // Manually sanitize content here e.content = sanitizedContent; }); ```</p> <p>### Acknowledgements Tiny Technologies would like to thank William Bowling for discovering this vulnerability.</p> <p>### References https://www.tiny.cloud/docs/release-notes/release-notes59/#securityfixes</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud) * Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)</p> https://cve.radiocsirt.org/vuln/ghsa-5h9g-x5rv-25wg https://cve.radiocsirt.org/vuln/gsd-2024-21908 gsd-2024-21908 https://cve.radiocsirt.org/vuln/gsd-2024-21908 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-21908 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce</p> <p>TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user&#39;s browser.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce</p> <p>TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user&#39;s browser.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-21908