Section

Vulnerabilities

CVE records from NVD, ZDI advisories and the CISA KEV catalog, with CVSS, EPSS, SSVC and exploitation state.

5 matching records.

1. 33
   CVE NVD 3h ago

   SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes…

   SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values…

   CVSS 9.3 CVE-2026-124494 JiHong88
2. 33
   CVE NVD 3h ago

   SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into…

   SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6…

   CVSS 9.3 CVE-2026-124493 JiHong88
3. 25
   CVE NVD 3h ago

   SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded…

   SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping.…

   CVSS 7.6 CVE-2026-124492 JiHong88
4. 18
   CVE NVD 3h ago

   SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned…

   SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with…

   CVSS 6.4 CVE-2026-124491 JiHong88
5. 18
   CVE NVD 15h ago

   SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from…

   SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can…

   CVSS 6.1 CVE-2026-124422 Jihong88

Same filters as JSON: /api/items?category=vuln&window=30d&vendor=Jihong88&limit=100. RSS for this section: feed.xml.