https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T15:08:44.905663+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2022-24728 CVE-2022-24728 — Cross-site Scripting in CKEditor4 2026-09-29T15:08:44.923567+00:00

Affected: ckeditor4

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

 https://vulnerability.circl.lu/vuln/usn-7258-1 USN-7258-1 — ckeditor vulnerabilities 2026-09-29T15:08:44.923660+00:00

Affected: Ubuntu:Pro:16.04:LTS: ckeditor, Ubuntu:Pro:18.04:LTS: ckeditor, Ubuntu:Pro:20.04:LTS: ckeditor, Ubuntu:Pro:22.04:LTS: ckeditor, Ubuntu:Pro:24.04:LTS: ckeditor

Kevin Backhouse discovered that CKEditor did not properly sanitize HTML content. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24728)

It was discovered that CKEditor did not properly handle the creation of editor instances in the Iframe Dialog and Media Embed packages. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28439)

It was discovered that CKEditor did not properly handle parsing HTML content. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. (CVE-2024-24815, CVE-2024-24816)

It was discovered that CKEditor did not properly sanitize version notifications. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411)