drupal-oembed-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · drupal-oembed-ssrf drupal-oembed-ssrf Class: SSRF Reach: Remote Drupal core 11.4.8 61044508 - Drupal SA-CORE-2026-008 gated the discovery document host with mediaoembeddiscoverytrustedhostpatterns. UrlResolver::findUr...

Malicious Package

Overview ckeditor5-ckbox is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15549 Malicious code in ckeditor5-ckbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7 Unscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a preinstall hook node index.js th...

Malicious code in ckeditor5-ckbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7 Unscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a preinstall hook node index.js th...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

Malicious code in ckeditor5-minimap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f65f71fdee0224ec38d03c631d1df1a8454347b6d82cfda912b11d387052898c The package ckeditor5-minimap was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2667 Malicious code in ckeditor5-minimap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f65f71fdee0224ec38d03c631d1df1a8454347b6d82cfda912b11d387052898c The package ckeditor5-minimap was found to contain malicious code. Source: ossf-package-analysis...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +5716 more potentially affected by CVE-2021-23337 +1 more via lodash-es (>=4.0.0, <=4.18.0)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.3.4, =0.4.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.5.0 and more Source cves: CVE-2021-23337, CVE-2026-4800 Source advisory: SNYK:JS-LODASHES-15869627...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-33151 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-33151 Source...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +1486 more potentially affected by CVE-2026-28343 via ckeditor5 (>=29.2.0, <=47.6.0-alpha.9)

ckeditor5 NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =29.2.0, =2.0.0, =30.0.0, =0.7.0, =1.0.0, =0.0.3, =0.0.6, =1.3.0, =1.5.3 and more Source cves: CVE-2026-28343 Source advisory: MEND:CVE-2026-28343...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +669 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: MEND:CVE-2026-28343...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +1486 more potentially affected by CVE-2026-28343 via ckeditor5 (>=29.2.0, <=47.6.0-alpha.9)

ckeditor5 NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =29.2.0, =2.0.0, =30.0.0, =0.7.0, =1.0.0, =0.0.3, =0.0.6, =1.3.0, =1.5.3 and more Source cves: CVE-2026-28343 Source advisory: OSV:GHSA-JRQM-VMQC-GM93...

Cross-site Scripting (XSS)

Overview @ckeditor/ckeditor5-engine is a The editing engine of CKEditor 5 – the best browser-based rich text editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via its unsafe htmlSupport configuration. An attacker can execute unauthorized JavaScript in the editor...

@7365admin1/layer-common (>=3.0.8, <=4.127.0), @_sh/strapi-plugin-ckeditor (>=7.0.0, <=7.1.0) +95 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-engine (>=47.0.0-alpha.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-engine NPM version =47.0.0-alpha.0, =3.0.8, =7.0.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0,...

@7365admin1/layer-common (>=3.0.8, <=4.127.0), @_sh/strapi-plugin-ckeditor (>=7.0.0, <=7.1.0) +95 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=47.0.0-alpha.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-html-support NPM version =47.0.0-alpha.0, =3.0.8, =7.0.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +1486 more potentially affected by CVE-2026-28343 via ckeditor5 (>=29.2.0, <=47.6.0-alpha.9)

ckeditor5 NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =29.2.0, =2.0.0, =30.0.0, =0.7.0, =1.0.0, =0.0.3, =0.0.6, =1.3.0, =1.5.3 and more Source cves: CVE-2026-28343 Source advisory: GHSA-JRQM-VMQC-GM93...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +669 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: GHSA-JRQM-VMQC-GM93...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +669 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.6.0-alpha.9)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: OSV:GHSA-JRQM-VMQC-GM93...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +4583 more potentially affected by CVE-2025-13465 via lodash-es (>=4.0.0, <=4.17.22)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.7.0, =1.0.0, =0.1.3, =0.0.4, =0.1.0, =0.0.1-alpha.4, =1.0.1, =1.0.23 and more Source cves: CVE-2025-13465 Source advisory: SNYK:JS-LODASHES-15053836...