https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:50:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337117 EUVD-2026-337117 https://cve.radiocsirt.org/vuln/euvd-2026-337117 https://cve.radiocsirt.org/vuln/fkie_cve-2024-21911 <p>TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user&#39;s browser.</p> <p>TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user&#39;s browser.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-21911 https://cve.radiocsirt.org/vuln/ghsa-w7jx-j77m-wp65 <p><strong>Affected:</strong> npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce</p> <p>### Impact A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are using TinyMCE 5.5.1 or lower.</p> <p>### Patches This vulnerability has been patched in TinyMCE 5.6.0 by improved URL sanitization logic.</p> <p>### Workarounds To work around this vulnerability, either: - Upgrade to TinyMCE 5.6.0 or higher - Manually sanitize `iframe`, `object` and `embed` URL attributes using a [TinyMCE node filter](https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.domparser/#addnodefilter). - Disable `iframe`, `object`, and `embed` elements in your content using the [invalid_elements](https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements) setting.</p> <p>#### Example: Sanitizing using a node filter ```js editor.parser.addNodeFilter(&#39;iframe,object,embed&#39;, function(nodes) { nodes.forEach(function(node) { if (node.attributes) { node.attributes.forEach(function(attr) { var name = attr.name; var value = attr.value; // Sanitize the attribute value here or remove it entirely var sanitizedValue = ...; node.attr(name, santizedValue); }); } }); }); ```</p> <p>#### Example: Using invalid_elements ```js invalid_elements: &#39;iframe,object,embed&#39; ```</p> <p>### Acknowledgements Tiny Technologies would like to th…</p> <p><strong>Affected:</strong> npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce</p> <p>### Impact A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are using TinyMCE 5.5.1 or lower.</p> <p>### Patches This vulnerability has been patched in TinyMCE 5.6.0 by improved URL sanitization logic.</p> <p>### Workarounds To work around this vulnerability, either: - Upgrade to TinyMCE 5.6.0 or higher - Manually sanitize `iframe`, `object` and `embed` URL attributes using a [TinyMCE node filter](https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.domparser/#addnodefilter). - Disable `iframe`, `object`, and `embed` elements in your content using the [invalid_elements](https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements) setting.</p> <p>#### Example: Sanitizing using a node filter ```js editor.parser.addNodeFilter(&#39;iframe,object,embed&#39;, function(nodes) { nodes.forEach(function(node) { if (node.attributes) { node.attributes.forEach(function(attr) { var name = attr.name; var value = attr.value; // Sanitize the attribute value here or remove it entirely var sanitizedValue = ...; node.attr(name, santizedValue); }); } }); }); ```</p> <p>#### Example: Using invalid_elements ```js invalid_elements: &#39;iframe,object,embed&#39; ```</p> <p>### Acknowledgements Tiny Technologies would like to th…</p> https://cve.radiocsirt.org/vuln/ghsa-w7jx-j77m-wp65 https://cve.radiocsirt.org/vuln/gsd-2024-21911 gsd-2024-21911 https://cve.radiocsirt.org/vuln/gsd-2024-21911 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-21911 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce</p> <p>TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user&#39;s browser.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce</p> <p>TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user&#39;s browser.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-21911