https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-06T01:28:23.466329+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-116675 CVE-2026-116675 — TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization 2026-11-06T01:28:23.484952+00:00

Affected: tinymce

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.