{"vulnerability": "CVE-2026-2834", "sightings": [{"uuid": "f328bfb0-5132-4910-ad2f-07c2b2c6b069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2834", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjj4n6s5yj2k", "content": "", "creation_timestamp": "2026-04-15T05:04:26.149645Z"}, {"uuid": "89d6de91-b12f-4b15-b261-99378026838b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2834", "type": "seen", "source": "Telegram/xHZW3dnIVlZ81UM5ayk21xAksqc_QlW_sb2BCoesl5IB3eE", "content": "", "creation_timestamp": "2026-04-22T21:20:26.000000Z"}, {"uuid": "2a182f68-5dba-4ae9-8e47-37e8204b37ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28348", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmtqfbqgri2a", "content": "\ud83d\udd17 CVE : CVE-2026-28348, CVE-2026-28350", "creation_timestamp": "2026-05-27T14:40:07.814769Z"}, {"uuid": "3dc03316-311c-47d0-9ca8-1b399b7eaca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28348", "type": "published-proof-of-concept", "source": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-hw26-mmpg-fqfg", "content": "", "creation_timestamp": "2026-03-02T08:20:21.000000Z"}, {"uuid": "0a1b51db-b06b-4dab-95a0-56fb45022598", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28342", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp", "content": "", "creation_timestamp": "2026-03-01T23:34:09.000000Z"}, {"uuid": "221310a0-0762-4ca8-871c-75c18e24bf05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28343", "type": "seen", "source": "https://gist.github.com/MaximeL/098a081d25d064519eed08b1f77a80d6", "content": "# Mise \u00e0 jours de ck-editor5 - 43.0.0 (install\u00e9) -> 47.7.5 (package.json)\n\n## 46.0.0 (2025-07-09) \u2014 MAJOR (gros)\n- Feature premium: Line Height\n- Remove Format nettoie styles blocs/tables/images + GHS\n- Marqueurs de listes (puces/numeros) heritent du style du texte (opt-out possible) \u2014 actif par defaut, contenu peut changer au chargement\n- Markdown: passage a l'ecosysteme unified (remark/rehype, remplace marked/turndown)\n- cloudServices.autoRefresh (refresh manuel du token)\n- addCommandThread: creation sur plages custom + commentaire initial; MINOR BREAKING AddCommandThreadCommand#isEnabled (utiliser hasContent)\n- MAJOR BREAKING: unification exports API (renommages nombreux, guide update-to-46 + migrating-imports); styles de contenu par defaut sur .ck-content (variables --ck-content-font-family/size/color/line-height/word-break, Helvetica/medium/#000/1.5/break-word); variables CSS renommees --ck-content-* (Highlight, Image, List, Table, ToC) et *-table-*; marges  dans \n et dans / supprimees; styles par defaut des annotations de commentaires changes (--ck-comment-content-*)\n- AI Assistant: gpt-4o par defaut (au lieu de gpt-3.5-turbo), max_tokens illimite\n\n## 46.0.1 (2025-08-11)\n- Pagination amelioree (styles de contenu, bookmarks, tolerance, grandes tables/images), tables dans export PDF\n- Doc redesign (rien pour integrateurs)\n\n## 46.0.2 (2025-08-19)\n- Hotfix: threads archives n'apparaissent plus dans la sidebar\n\n## 46.0.3 (2025-09-03) \u2014 securite\n- CVE-2025-58064 (XSS clipboard, html-embed / RawElement) backporte en 46.x\n\n## 46.1.0 (2025-09-10)\n- Drag & drop widgets iOS, pagination (revert changement bas niveau, grandes tables), flag hidden_in_presence_list (Server-side editor API), markers orphelins de threads supprimes automatiquement\n- MINOR BREAKING RTC: CloudServicesCommentsAdapter#getCommentThread retourne null au lieu de throw\n\n## 46.1.1 (2025-09-15)\n- Interne (Yarn -> pnpm), aucun impact integrateurs\n\n## 47.0.0 (2025-10-01) \u2014 MAJOR, premiere release LTS\n- CKEditor AI early access (Chat, Quick Actions, Review) \u2014 service CKEditor cloud\n- LTS Edition: v47.x = 6 mois dev actif puis maintenance jusqu'a 3 ans; a partir d'avril 2026 les 47.7.x+ sont reservees aux licences LTS commerciales\n- Widgets: Tab/Shift+Tab ameliore dans editables imbriques\n- Dialog#show() positionnement programmatique\n- MAJOR BREAKING ai: restructuration config (ai.aiAssistant -> ai.assistant, ai.useTheme -> ai.assistant.useTheme, ai.aws -> ai.assistant.adapter.aws, ai.openAI -> ai.assistant.adapter.openAI)\n\n## 47.1.0 (2025-10-16)\n- Stabilite; MINOR BREAKING ai: CSS sidebar simplifie (min-height .ck-ai-chat, height .ck-tabs, width .ck-ai-tabs, --ck-tabs-panels-container-width supprimee)\n\n## 47.2.0 (2025-11-05)\n- CKEditor AI GA (Chat, Quick Actions, Review; selection de modele GPT-5/Claude/Gemini)\n- Features premium: Footnotes (numerotation personnalisable), Restricted editing au niveau bloc\n- Old installation methods: sunset etendu fin Q1 2026\n- Fixes: placeholders residuels dans view engine, elementToStructure (listes/structures imbriquees)\n\n## 47.3.0 (2025-12-03)\n- AI: filtre de recherche dans Quick Actions (config.ai.quickActions.isSearchEnabled), marqueurs TC gris dans preview AI\n- Flags experimentaux (defaut en 48.0.0): useExtendedTableBlockAlignment, upcastTableBorderZeroAttributes, modelInsertContentDeepSchemaVerification (+ plugins TablePropertiesUIExperimental)\n\n## 47.4.0 (2026-01-14)\n- Experimental tableCellTypeSupport (bascule th/td)\n- config.table.showHiddenBorders (bordures pointillees pour tables sans bordures, actif par defaut)\n- Email: images redimensionnees dans Outlook, useFigureToTableFallback\n- Images: CSS float:left/right mappes sur alignement image\n- Emoji v17.0 dataset dispo\n\n## 47.5.0 (2026-02-11)\n- AI Translate (traduction du document)\n- AI Chat: cartes de changements multiples\n- Export to PDF v2 (headers/footers par page, formats, metadonnees, mot de passe owner, signature PKCS#12, outline)\n- MINOR BREAKING ai (nombreux): ai.reviewMode.translations -> ai.translate.languages; AIEditorIntegration requis pour preview dialog; DOM chat restructure; sendMessage(attributes); showModelSelector (ex modelSelectorAlwaysVisible); config.ai.chat.models -> config.ai.models\n\n## 47.6.0 (2026-03-04) \u2014 securite\n- CVE-2026-28343: XSS General HTML Support (config autorisant markup unsafe)\n- AI on-premises (modeles custom, MCP)\n- Custom AI Review checks (extraCommands/availableCommands); AI Chat Shortcuts\n- Indentation de listes re travail (listes entieres + items, compatible Paste from Office/Export/TC, RTL)\n- @aws-sdk/client-bedrock-runtime maj (fast-xml-parser) \u2014 dynamic imports (impact bundles webpack, dynamicImportMode: 'eager')\n- MINOR BREAKING ai: message d'accueil chat simplifie (config.ai.chat.welcomeMessage pour restaurer)\n\n## 47.6.1 (2026-03-11)\n- Patch: 3 regressions de la 47.6.0\n\n## 47.6.2 (2026-04-08) \u2014 dernier point publique de la branche 47 non-LTS\n(non detail dans digest, patch)", "creation_timestamp": "2026-10-02T08:48:30.000000Z"}]}