CVE and update status of the FreeBSD ports tree3,614 unaddressed CVEs in 711 portsAll times are CET
CVE details

CVE-2026-116675

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.

Score
8.5 high
Published
2026-10-27
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
www/tinymcetinymce8.9.1unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>tinymce</name>
	<range><lt>8.9.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and
	from 8.5.1 until 8.9.3, the media plugin creates elements crafted
	through data-mce-object in the active document before sanitization.
	Those elements can execute malicious scripts during processing,
	resulting in stored cross-site scripting for users with the media
	plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-116675</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-116675</url>
    </references>
    <dates>
      <discovery>2026-10-27</discovery>
      <entry>2026-10-27</entry>
    </dates>
  </vuln>