CVE-2026-116675

A flaw was found in TinyMCE. The media plugin creates elements in the active document before input sanitization occurs. An attacker can exploit this vulnerability by injecting specially crafted media attributes into a document, resulting in stored cross-site scripting XSS. When another user views...

CVE-2026-42841

Grav CMS stores image attributes via Markdown media action parameters. Before 2.0.0-beta.2, an authenticated page editor could inject a JavaScript event handler by calling attribute(name, value) through image query parameters (e.g., ?attribute=onload,alert(...)). The attack results in a stored XS...

Asterisk PJSIP Invalid Media Attribute Denial Of Service (CVE-2018-1000099)

A denial-of-service vulnerability exists in Asterisk PJSIP. The vulnerability is due to improper validation of SDP Media Attributes. Successful exploitation can result in denial-of-service conditions...