1067 matches found
CVE-2019-12836
CVE-2019-12836 Application JEditor v3.0.5 - WYSIWIG Editor for JIRA Simple yet powerful rich text editor for Jira. Import HTML emails, paste rich contents, create templates and prepopulate fields. Vendor of Product Bobronix Vendor Website http://bobronix.com/ CVE Reference...
CVE-2026-34212
CVE-2026-34212 Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin. Intro I identified, responsibly disclosed, and reproduced a High-severity stored XSS issue in Docmost , the...
CVE-2026-120350
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350 Stored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350
The Vaadin Rich Text Editor is vulnerable to Stored Cross-Site Scripting (XSS) due to an unescaped video embed export. The component fails to escape values during export and subsequently parses the resulting HTML into the live DOM, allowing a crafted payload to break out of the href attribute. Th...
EUVD-2026-120894
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350 Stored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
Stored cross-site scripting in the Vaadin Rich Text Editor via an unescaped video embed
The Vaadin Rich Text Editor exports a video embed without escaping its value and then parses the resulting HTML into live DOM, so a crafted embed runs script in the browser of anyone who opens the page. Only content persisted through asDelta is affected: the default HTML value is sanitized on the...
PT-2026-141593
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CVE-2026-120350: vaadin: The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into…
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...
CLEANSTART-2024-RD11689 When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters
Security vulnerability affects the librewolf package. When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters...
CLEANSTART-2024-RR45298 When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule
Security vulnerability affects the librewolf package. When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule...
[SECURITY] Fedora 45 Update: ghostwriter-26.08.2-1.fc45
Ghostwriter is a text editor for Markdown, which is a plain text markup format created by John Gruber. For more information about Markdown, please visit John Gruber=E2=80=99s website at http://www.daringfireball.net. Ghostwriter provides a relaxing, distraction-free writing environment, whether...
[SECURITY] Fedora 45 Update: xed-3.9.0-2.fc45
Xed is a small, but powerful text editor. It has most standard text editor functions and fully supports international text in Unicode. Advanced features include syntax highlighting and automatic indentation of source code, printing and editing of multiple documents in one window. Xed is extensibl...
[SECURITY] Fedora 45 Update: pluma-1.28.1-4.fc45
pluma is a small, but powerful text editor designed specifically for the MATE desktop. It has most standard text editor functions and fully supports international text in Unicode. Advanced features include syntax highlighting and automatic indentation of source code, printing and editing of...
CVE-2026-90438
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...
[SECURITY] Fedora 45 Update: gnome-text-editor-51.0-1.fc45
GNOME Text Editor is a simple text editor that focuses on session management. It works hard to keep track of changes and state even if you quit the applica tion. You can come back to your work even if you've never saved it to a file...
CVE-2026-96326
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-88602
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...