@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-33151 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-33151 Source...

CKEditor < 47.6.0 XSS

The version of CKEditor included on the remote web host prior to 47.6.0. It may, therefore, be affected by a cross-site scripting XSS vulnerability. - CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Prior to version 47.6.0, a cross-site scripting XSS vulnerability has...

Linux Distros Unpatched Vulnerability : CVE-2026-28343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS...

CVE-2026-28343

A flaw was found in CKEditor. This cross-site scripting XSS vulnerability in the General HTML Support feature allows an attacker to execute unauthorized JavaScript code. This can occur by inserting specially crafted markup if the editor instance is configured with unsafe General HTML Support...

CVE-2026-28343

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

UBUNTU-CVE-2026-28343

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

CVE-2026-28343

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

CVE-2026-28343 CKEditor: Cross-site scripting (XSS) in the HTML Support package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

CVE-2026-28343

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

CVE-2026-28343 CKEditor: Cross-site scripting (XSS) in the HTML Support package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

CVE-2026-28343 CKEditor: Cross-site scripting (XSS) in the HTML Support package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +670 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: MEND:CVE-2026-28343...

CVE-2026-28343

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

CKEditor 跨站脚本漏洞

CKEditor is an open-source enterprise-level WYSIWYG editor developed by CKEditor. Versions of CKEditor prior to 47.6.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from the General HTML Support feature, which allowed cross-site scripting, potentially enabling the...

CVE-2026-28343: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

@7365admin1/layer-common (>=3.0.8, <=4.116.0), @_sh/strapi-plugin-ckeditor (>=7.0.0, <=7.1.0) +95 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-engine (>=47.0.0-alpha.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-engine NPM version =47.0.0-alpha.0, =3.0.8, =7.0.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0,...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +670 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: OSV:GHSA-JRQM-VMQC-GM93...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +670 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: GHSA-JRQM-VMQC-GM93...

Cross-site Scripting (XSS)

Overview @ckeditor/ckeditor5-html-support is a HTML Support feature for CKEditor 5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via its unsafe htmlSupport configuration. An attacker can execute unauthorized JavaScript in the editor context by inserting specially...

@7365admin1/layer-common (>=3.0.8, <=4.116.0), @_sh/strapi-plugin-ckeditor (>=7.0.0, <=7.1.0) +95 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=47.0.0-alpha.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-html-support NPM version =47.0.0-alpha.0, =3.0.8, =7.0.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0...