CVE WATCH / VULNERABILITY DETAIL
CVE-2026-124491
MEDIUMCVSS 6.4NVD feed
Published 8 November 2026 · tracked since 9 November 2026
Description
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' bro
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-125198 LOW 2.5
- CVE-2026-125041 MEDIUM 5.5
- CVE-2026-125040 MEDIUM 6.5
- CVE-2026-121769 HIGH 8.5
- CVE-2026-60117 MEDIUM 6.2
- CVE-2026-123796
- CVE-2026-123373
- CVE-2026-123372
- CVE-2026-123371
- CVE-2026-123370