Tinymce/tinymce
11 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Tinymce/tinymce, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Tinymce/tinymce CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 11 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Medium11
Latest CVEs
The 11 most recently published vulnerabilities affecting Tinymce/tinymce.
- CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements6.1
- CVE-2024-38356TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option6.1
- CVE-2024-29881TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements4.3
- CVE-2024-29203TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes4.3
- CVE-2024-21911Cross-site scripting vulnerability in TinyMCE6.1
- CVE-2024-21910Cross-site scripting vulnerability in TinyMCE plugins6.1
- CVE-2024-21908Cross-site scripting vulnerability in TinyMCE6.1
- CVE-2023-48219Special characters in unescaped text nodes can trigger mXSS in TinyMCE6.1
- CVE-2023-45818Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin6.1
- CVE-2023-45819Cross-site Scripting vulnerability in TinyMCE notificationManager.open API6.1
- CVE-2022-23494Cross-site scripting vulnerability in TinyMCE alerts5.4
Product grouping is registry-driven, with AI assist and human review. How it works