https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 21:54:55 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120350 <p>The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer&#39;s browser. An attacker who can edit shared content pastes a video embed carrying the payload, the delta is stored, and the script runs when any user opens the page, including in read only mode.</p> <p>Only content persisted through asDelta() is affected. The default HTML value, set and read through setValue and getValue, is sanitized on the server with a safelist that has no iframe, so the embed does not survive that path. Vaadin 24 and older are not affected: they build the HTML value from the editor&#39;s own innerHTML, which the browser escapes.</p> <p>Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:</p> <p>Product version Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.12 Vaadin 25.3.0 - 25.3.4</p> <p>Mitigation No fixed release on this line, upgrade to 25.2.13 or newer No fixed release on this line, upgrade to 25.2.13 or newer Upgrade to 25.2.13 Upgrade to 25.3.5</p> <p>The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer&#39;s browser. An attacker who can edit shared content pastes a video embed carrying the payload, the delta is stored, and the script runs when any user opens the page, including in read only mode.</p> <p>Only content persisted through asDelta() is affected. The default HTML value, set and read through setValue and getValue, is sanitized on the server with a safelist that has no iframe, so the embed does not survive that path. Vaadin 24 and older are not affected: they build the HTML value from the editor&#39;s own innerHTML, which the browser escapes.</p> <p>Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:</p> <p>Product version Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.12 Vaadin 25.3.0 - 25.3.4</p> <p>Mitigation No fixed release on this line, upgrade to 25.2.13 or newer No fixed release on this line, upgrade to 25.2.13 or newer Upgrade to 25.2.13 Upgrade to 25.3.5</p> https://db.gcve.eu/vuln/fkie_cve-2026-120350 https://db.gcve.eu/vuln/wid-sec-w-2026-4502 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Vaadin ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Vaadin ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4502