CVE Browser

Search and filter CVEs by severity, ecosystem, EPSS score, and more.

Today 105 Last 7 days 2,875 Total CVEs 401,237 CISA KEV 1,733 Critical 42,399 All stats

Page 1

CVE-2025-13980 MEDIUM

CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118

CVSS 5.3 EPSS 0.27% Jan 28, 2026

CVE-2016-20023 MEDIUM

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.

CVSS 6.5 EPSS 0.34% Dec 5, 2025

CVE-2025-63830 MEDIUM

CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.

CVSS 6.1 EPSS 0.25% Nov 14, 2025

CVE-2024-13245 MEDIUM

CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

CVSS 5.4 EPSS 0.22% Jan 9, 2025

CVE-2023-4771 MEDIUM

Cross-Site Scripting vulnerability in CKSource CKEditor

CVSS 6.1 EPSS 0.88% Nov 16, 2023

npm

CVE-2011-4972 HIGH

hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private…

CVSS 7.5 EPSS 1.74% Nov 13, 2019

CVE-2019-15891 MEDIUM

An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that th…

CVSS 5.3 EPSS 1.09% Sep 26, 2019

CVE-2019-15862 HIGH

An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the a…

CVSS 7.5 EPSS 1.52% Sep 26, 2019

CVE-2015-9349 MEDIUM

The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.

CVSS 6.1 EPSS 0.91% Aug 27, 2019

CVE ID	Description	Severity	CVSS	EPSS	Ecosystems	Published
CVE-2025-13980	CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118	MEDIUM	5.3	0.27%		Jan 28, 2026
CVE-2016-20023	In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.	MEDIUM	6.5	0.34%		Dec 5, 2025
CVE-2025-63830	CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.	MEDIUM	6.1	0.25%		Nov 14, 2025
CVE-2024-13245	CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009	MEDIUM	5.4	0.22%		Jan 9, 2025
CVE-2023-4771	Cross-Site Scripting vulnerability in CKSource CKEditor	MEDIUM	6.1	0.88%	npm	Nov 16, 2023
CVE-2011-4972	hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private…	HIGH	7.5	1.74%		Nov 13, 2019
CVE-2019-15891	An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that th…	MEDIUM	5.3	1.09%		Sep 26, 2019
CVE-2019-15862	An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the a…	HIGH	7.5	1.52%		Sep 26, 2019
CVE-2015-9349	The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.	MEDIUM	6.1	0.91%		Aug 27, 2019

Rows per page

Showing 1 to 9 CVEs · page 1