https://vulnerability.circl.lu/sightings/feed 2026-10-03T12:22:11.169177+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/221310a0-0762-4ca8-871c-75c18e24bf05/export 2026-10-03T12:22:11.188276+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "221310a0-0762-4ca8-871c-75c18e24bf05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28343", "type": "seen", "source": "https://gist.github.com/MaximeL/098a081d25d064519eed08b1f77a80d6", "content": "# Mise \u00e0 jours de ck-editor5 - 43.0.0 (install\u00e9) -> 47.7.5 (package.json)\n\n## 46.0.0 (2025-07-09) \u2014 MAJOR (gros)\n- Feature premium: Line Height\n- Remove Format nettoie styles blocs/tables/images + GHS\n- Marqueurs de listes (puces/numeros) heritent du style du texte (opt-out possible) \u2014 actif par defaut, contenu peut changer au chargement\n- Markdown: passage a l'ecosysteme unified (remark/rehype, remplace marked/turndown)\n- cloudServices.autoRefresh (refresh manuel du token)\n- addCommandThread: creation sur plages custom + commentaire initial; MINOR BREAKING AddCommandThreadCommand#isEnabled (utiliser hasContent)\n- MAJOR BREAKING: unification exports API (renommages nombreux, guide update-to-46 + migrating-imports); styles de contenu par defaut sur .ck-content (variables --ck-content-font-family/size/color/line-height/word-break, Helvetica/medium/#000/1.5/break-word); variables CSS renommees --ck-content-* (Highlight, Image, List, Table, ToC) et *-table-*; marges dans \n et dans / supprimees; styles par defaut des annotations de commentaires changes (--ck-comment-content-*)\n- AI Assistant: gpt-4o par defaut (au lieu de gpt-3.5-turbo), max_tokens illimite\n\n## 46.0.1 (2025-08-11)\n- Pagination amelioree (styles de contenu, bookmarks, tolerance, grandes tables/images), tables dans export PDF\n- Doc redesign (rien pour integrateurs)\n\n## 46.0.2 (2025-08-19)\n- Hotfix: threads archives n'apparaissent plus dans la sidebar\n\n## 46.0.3 (2025-09-03) \u2014 securite\n- CVE-2025-58064 (XSS clipboard, html-embed / RawElement) backporte en 46.x\n\n## 46.1.0 (2025-09-10)\n- Drag & drop widgets iOS, pagination (revert changement bas niveau, grandes tables), flag hidden_in_presence_list (Server-side editor API), markers orphelins de threads supprimes automatiquement\n- MINOR BREAKING RTC: CloudServicesCommentsAdapter#getCommentThread retourne null au lieu de throw\n\n## 46.1.1 (2025-09-15)\n- Interne (Yarn -> pnpm), aucun impact integrateurs\n\n## 47.0.0 (2025-10-01) \u2014 MAJOR, premiere release LTS\n- CKEditor AI early access (Chat, Quick Actions, Review) \u2014 service CKEditor cloud\n- LTS Edition: v47.x = 6 mois dev actif puis maintenance jusqu'a 3 ans; a partir d'avril 2026 les 47.7.x+ sont reservees aux licences LTS commerciales\n- Widgets: Tab/Shift+Tab ameliore dans editables imbriques\n- Dialog#show() positionnement programmatique\n- MAJOR BREAKING ai: restructuration config (ai.aiAssistant -> ai.assistant, ai.useTheme -> ai.assistant.useTheme, ai.aws -> ai.assistant.adapter.aws, ai.openAI -> ai.assistant.adapter.openAI)\n\n## 47.1.0 (2025-10-16)\n- Stabilite; MINOR BREAKING ai: CSS sidebar simplifie (min-height .ck-ai-chat, height .ck-tabs, width .ck-ai-tabs, --ck-tabs-panels-container-width supprimee)\n\n## 47.2.0 (2025-11-05)\n- CKEditor AI GA (Chat, Quick Actions, Review; selection de modele GPT-5/Claude/Gemini)\n- Features premium: Footnotes (numerotation personnalisable), Restricted editing au niveau bloc\n- Old installation methods: sunset etendu fin Q1 2026\n- Fixes: placeholders residuels dans view engine, elementToStructure (listes/structures imbriquees)\n\n## 47.3.0 (2025-12-03)\n- AI: filtre de recherche dans Quick Actions (config.ai.quickActions.isSearchEnabled), marqueurs TC gris dans preview AI\n- Flags experimentaux (defaut en 48.0.0): useExtendedTableBlockAlignment, upcastTableBorderZeroAttributes, modelInsertContentDeepSchemaVerification (+ plugins TablePropertiesUIExperimental)\n\n## 47.4.0 (2026-01-14)\n- Experimental tableCellTypeSupport (bascule th/td)\n- config.table.showHiddenBorders (bordures pointillees pour tables sans bordures, actif par defaut)\n- Email: images redimensionnees dans Outlook, useFigureToTableFallback\n- Images: CSS float:left/right mappes sur alignement image\n- Emoji v17.0 dataset dispo\n\n## 47.5.0 (2026-02-11)\n- AI Translate (traduction du document)\n- AI Chat: cartes de changements multiples\n- Export to PDF v2 (headers/footers par page, formats, metadonnees, mot de passe owner, signature PKCS#12, outline)\n- MINOR BREAKING ai (nombreux): ai.reviewMode.translations -> ai.translate.languages; AIEditorIntegration requis pour preview dialog; DOM chat restructure; sendMessage(attributes); showModelSelector (ex modelSelectorAlwaysVisible); config.ai.chat.models -> config.ai.models\n\n## 47.6.0 (2026-03-04) \u2014 securite\n- CVE-2026-28343: XSS General HTML Support (config autorisant markup unsafe)\n- AI on-premises (modeles custom, MCP)\n- Custom AI Review checks (extraCommands/availableCommands); AI Chat Shortcuts\n- Indentation de listes re travail (listes entieres + items, compatible Paste from Office/Export/TC, RTL)\n- @aws-sdk/client-bedrock-runtime maj (fast-xml-parser) \u2014 dynamic imports (impact bundles webpack, dynamicImportMode: 'eager')\n- MINOR BREAKING ai: message d'accueil chat simplifie (config.ai.chat.welcomeMessage pour restaurer)\n\n## 47.6.1 (2026-03-11)\n- Patch: 3 regressions de la 47.6.0\n\n## 47.6.2 (2026-04-08) \u2014 dernier point publique de la branche 47 non-LTS\n(non detail dans digest, patch)", "creation_timestamp": "2026-10-02T08:48:30.000000Z"} 2026-10-02T08:48:30+00:00 https://vulnerability.circl.lu/sighting/9d5c3213-0bcd-402b-95d6-4c2c87096649/export 2026-10-03T12:22:11.191949+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9d5c3213-0bcd-402b-95d6-4c2c87096649", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "published-proof-of-concept", "source": "Telegram/3ezEsp5gK88wLpfJ-0VsxORLRAFRltvc0-oVPzDdZ7Y-3JQ", "content": "", "creation_timestamp": "2026-10-01T23:00:22.000000Z"} 2026-10-01T23:00:22+00:00 https://vulnerability.circl.lu/sighting/6a627187-3f88-479f-bf05-1df154f50f8b/export 2026-10-03T12:22:11.192086+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6a627187-3f88-479f-bf05-1df154f50f8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "Telegram/3ezEsp5gK88wLpfJ-0VsxORLRAFRltvc0-oVPzDdZ7Y-3JQ", "content": "", "creation_timestamp": "2026-10-01T23:00:22.000000Z"} 2026-10-01T23:00:22+00:00 https://vulnerability.circl.lu/sighting/ab8659c4-4010-4596-a6e1-983d35d48343/export 2026-10-03T12:22:11.192188+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ab8659c4-4010-4596-a6e1-983d35d48343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28992", "type": "published-proof-of-concept", "source": "Telegram/MxpSJDiLC1K8qY5cY_EOI6Qu4ox5EFXjmcn2Wz_vCyHD2pc", "content": "", "creation_timestamp": "2026-09-30T23:00:24.000000Z"} 2026-09-30T23:00:24+00:00 https://vulnerability.circl.lu/sighting/3906ca16-4f92-4cc1-b279-69a646225414/export 2026-10-03T12:22:11.192280+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3906ca16-4f92-4cc1-b279-69a646225414", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28992", "type": "seen", "source": "Telegram/MxpSJDiLC1K8qY5cY_EOI6Qu4ox5EFXjmcn2Wz_vCyHD2pc", "content": "", "creation_timestamp": "2026-09-30T23:00:24.000000Z"} 2026-09-30T23:00:24+00:00 https://vulnerability.circl.lu/sighting/23d1f180-07f1-4fe0-8e08-872b218b622e/export 2026-10-03T12:22:11.192372+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "23d1f180-07f1-4fe0-8e08-872b218b622e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28992", "type": "published-proof-of-concept", "source": "Telegram/p8fCe73qPhNi0gtkgFiWePACon_RGM1KmaCzYKDKoMfuYzQ", "content": "", "creation_timestamp": "2026-09-30T23:00:22.000000Z"} 2026-09-30T23:00:22+00:00 https://vulnerability.circl.lu/sighting/5608aca0-4df0-48be-8ca0-1515e532ff5a/export 2026-10-03T12:22:11.192470+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5608aca0-4df0-48be-8ca0-1515e532ff5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28992", "type": "seen", "source": "Telegram/p8fCe73qPhNi0gtkgFiWePACon_RGM1KmaCzYKDKoMfuYzQ", "content": "", "creation_timestamp": "2026-09-30T23:00:22.000000Z"} 2026-09-30T23:00:22+00:00 https://vulnerability.circl.lu/sighting/b8bba3ac-3f68-472a-b225-891be4869113/export 2026-10-03T12:22:11.192567+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b8bba3ac-3f68-472a-b225-891be4869113", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28802", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwmq7gsbjq2c", "content": "An Authlib signature bypass vulnerability (CVE-2026-96760, CVE-2026-28802, CVE-2026-27962) lets attackers forge JWS payloads. Update libraries now.\n\n#Authlib #CVE202696760 #Cybersecurity #JWS #Vulnerability", "creation_timestamp": "2026-09-29T02:00:09.955734Z"} 2026-09-29T02:00:09.955734+00:00 https://vulnerability.circl.lu/sighting/6695cb69-3892-4048-99a8-35c370097a79/export 2026-10-03T12:22:11.192663+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6695cb69-3892-4048-99a8-35c370097a79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28695", "type": "seen", "source": "Telegram/OlS7mOCYJDdHF5bGuQyV5ccTCVSJsR8ZTmdToM9KjFzseyE", "content": "", "creation_timestamp": "2026-09-28T03:00:06.000000Z"} 2026-09-28T03:00:06+00:00 https://vulnerability.circl.lu/sighting/0bf895b0-5483-4d50-ac99-bee3b91e7f91/export 2026-10-03T12:22:11.192759+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0bf895b0-5483-4d50-ac99-bee3b91e7f91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28695", "type": "published-proof-of-concept", "source": "Telegram/OlS7mOCYJDdHF5bGuQyV5ccTCVSJsR8ZTmdToM9KjFzseyE", "content": "", "creation_timestamp": "2026-09-28T03:00:06.000000Z"} 2026-09-28T03:00:06+00:00