drupal-oembed-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · drupal-oembed-ssrf drupal-oembed-ssrf Class: SSRF Reach: Remote Drupal core 11.4.8 61044508 - Drupal SA-CORE-2026-008 gated the discovery document host with mediaoembeddiscoverytrustedhostpatterns. UrlResolver::findUr...

DRUPAL-CONTRIB-2026-230

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...

PT-2026-120907

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...

UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

CVE-2026-28343

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

CVE-2026-28343: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

PT-2026-7808

This module enables you to integrate and manage icons with Drupal. The module doesn't sufficiently sanitize user input leading to a reflected Cross-site Scripting XSS vulnerability. The vulnerability is mitigated by the fact that in order to be vulnerable, the "UI Icons for CKEditor 5" submodule...

CVE-2025-13980: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0...

EUVD-2021-0749

Malware in sbrugna...

EUVD-2018-0193

Malware in sbrugna...

EUVD-2021-0505

Malware in sbrugna...

EUVD-2025-4561

Malicious code in bioql PyPI...

EUVD-2022-6474

Malicious code in bioql PyPI...

CVE-2025-58064: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

CVE-2025-58064

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

PT-2025-36639

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which...

org.webjars.npm:ckeditor5 (>=44.1.0, <=44.3.0), org.webjars.npm:ckeditor__ckeditor5-adapter-ckfinder (>=44.1.0, <=44.3.0) +59 more potentially affected by CVE-2025-9670 via org.webjars.npm:turndown (7.2.0)

org.webjars.npm:turndown MAVEN version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:turndown and may be impacted: - org.webjars.npm:ckeditor5 =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0,...

CVE-2022-31175

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

CVE-2022-48110

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is addin...