Login Request a demo
CK
Product
ckeditor5
by ckeditor · last CVE Oct 27, 2026
9
CVEs
0
On KEV
8.1
Max CVSS
2
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 0High 1Medium 5Low 3
Severity
All severities9Critical0High1Medium5Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ckeditor5 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-116688
New
8.1
0%
Oct 27
CKEditor: Cross-site scripting (XSS) in the engine package
Affected: >= 45.0.0, < 47.7.4; >= 48.0.0, < 48.5.1
CVE-2021-21254
6.5
2%
Jan 29
CKEditor 5 is an open source rich text editor framework with a modular architecture
Affected: before 25.0.0
CVE-2026-28343
6.1
0%
Mar 5
CKEditor: Cross-site scripting (XSS) in the HTML Support package
Affected: >= 29.0.0, < 47.6.0
CVE-2024-45613
6.1
1%
Sep 25
CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package
Affected: >= 40.0.0, < 43.1.1
CVE-2025-61261
5.4
0%
Nov 7
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via…
Affected: 46.1.0
CVE-2022-31175
4.7
1%
Aug 3
Cross-site scripting caused by the editor instance destroying process in ckeditor5
Affected: < 35.0.1
CVE-2026-116687
New
3.1
0%
Oct 27
CKEditor: Cross-site scripting (XSS) in the engine package
Affected: >= 29.0.0, < 47.7.4; >= 48.0.0, < 48.5.1
CVE-2025-58064
2.3
0%
Sep 3
CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package
Affected: >= 46.0.0, < 46.0.3; >= 44.2.0, < 45.2.2
CVE-2025-25299
2.3
1%
Feb 20
Cross-site scripting (XSS) in the real-time collaboration package
Affected: @ckeditor/ckeditor5-real-time-collaboration: >= 41.3.0, < 44.2.1; ckeditor5-premium-features: >= 42.0.0, < 44.2.1
Showing 9