https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-29T05:12:55.357708+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-116687 CVE-2026-116687 — CKEditor: Cross-site scripting (XSS) in the engine package 2026-10-29T05:12:55.358666+00:00

Affected: ckeditor5

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.