https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 16:20:59 +0000 https://db.gcve.eu/vuln/cve-2026-88976 <p><strong>Affected:</strong> udecode plate</p> <p>Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application&#39;s origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.</p> <p><strong>Affected:</strong> udecode plate</p> <p>Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes. This can allow attacker-controlled script to execute in the consuming application&#39;s origin when another user loads the deserialized content. This issue is fixed in version 53.3.11.</p> https://db.gcve.eu/vuln/cve-2026-88976