https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T03:03:40.546347+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-90561 fkie_cve-2026-90561 2026-10-06T03:03:43.274640+00:00

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

 https://vulnerability.circl.lu/vuln/ghsa-jh7v-p6jw-jwhc GHSA-jh7v-p6jw-jwhc 2026-10-06T03:03:43.274745+00:00

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.