Vulnerability-Lookup

CVE-2026-28343 (GCVE-0-2026-28343)

Vulnerability from cvelistv5 – Published: 2026-03-05 19:42 – Updated: 2026-03-19 18:45

Title

CKEditor: Cross-site scripting (XSS) in the HTML Support package

Summary

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Severity ?

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/ckeditor/ckeditor5/security/ad…	x_refsource_CONFIRM
	https://github.com/ckeditor/ckeditor5/releases/ta…	x_refsource_MISC
	https://github.com/ckeditor/ckeditor5/releases/ta…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	ckeditor	ckeditor5	Affected: >= 29.0.0, < 47.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28343",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T17:56:09.434344Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T17:56:15.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ckeditor5",
          "vendor": "ckeditor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 29.0.0, \u003c 47.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T18:45:43.135Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93"
        },
        {
          "name": "https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0"
        },
        {
          "name": "https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jrqm-vmqc-gm93",
        "discovery": "UNKNOWN"
      },
      "title": "CKEditor: Cross-site scripting (XSS) in the HTML Support package"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28343",
    "datePublished": "2026-03-05T19:42:58.372Z",
    "dateReserved": "2026-02-26T18:38:13.889Z",
    "dateUpdated": "2026-03-19T18:45:43.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-28343\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-05T20:16:16.017\",\"lastModified\":\"2026-03-19T19:16:20.003\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.\"},{\"lang\":\"es\",\"value\":\"CKEditor 5 es un editor de texto enriquecido moderno de JavaScript con una arquitectura MVC. Antes de la versi\u00f3n 47.6.0, se ha descubierto una vulnerabilidad de cross-site scripting (XSS) en la funci\u00f3n de Soporte HTML General. Esta vulnerabilidad podr\u00eda activarse mediante la inserci\u00f3n de marcado especialmente dise\u00f1ado, lo que llevar\u00eda a la ejecuci\u00f3n no autorizada de c\u00f3digo JavaScript, si la instancia del editor utilizaba una configuraci\u00f3n insegura de Soporte HTML General. Este problema se ha corregido en la versi\u00f3n 47.6.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"47.6.0\",\"matchCriteriaId\":\"A6ADE9D9-13BD-491C-8B46-0A3D45582F03\"}]}]}],\"references\":[{\"url\":\"https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-28343\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-06T17:56:09.434344Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-06T17:56:12.556Z\"}}], \"cna\": {\"title\": \"CKEditor: Cross-site scripting (XSS) in the HTML Support package\", \"source\": {\"advisory\": \"GHSA-jrqm-vmqc-gm93\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"ckeditor\", \"product\": \"ckeditor5\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 29.0.0, \u003c 47.6.0\"}]}], \"references\": [{\"url\": \"https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93\", \"name\": \"https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0\", \"name\": \"https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0\", \"name\": \"https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-19T18:45:43.135Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-28343\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-19T18:45:43.135Z\", \"dateReserved\": \"2026-02-26T18:38:13.889Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-05T19:42:58.372Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-JRQM-VMQC-GM93

Vulnerability from github – Published: 2026-03-04 18:49 – Updated: 2026-03-19 18:45

Summary

CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package

Details

Impact

A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration.

This vulnerability affects only installations where the editor configuration meets the following criteria:

General HTML Support is enabled,
General HTML Support configuration allows inserting unsafe markup (see Security section to learn more).

Patches

The problem has been recognized and patched. The fix will be available in version 47.6.0 (and above).

Workarounds

CKEditor 5 recommends configuring General HTML Support securely to ensure that unsafe content is not accepted. Please refer to the Security section for detailed guidance.

Credits

CKEditor 5 would like to thank: - Emilio Kevin - Jeongwoo Lee, Younsoung Kim, Minseok Kim and Jinyeong Kim from ENKI Whitehat

for responsibly reporting this vulnerability.

For more information

Email us at security@cksource.com if you have any questions or comments about this advisory.

Severity ?

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@ckeditor/ckeditor5-html-support"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "29.0.0"
            },
            {
              "fixed": "47.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "ckeditor5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "29.0.0"
            },
            {
              "fixed": "47.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28343"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-04T18:49:32Z",
    "nvd_published_at": "2026-03-05T20:16:16Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nA Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration.\n\nThis vulnerability affects only installations where the editor configuration meets the following criteria:\n\n* [General HTML Support](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html) is enabled,\n* General HTML Support configuration allows inserting unsafe markup (see [Security](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html#security) section to learn more).\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version 47.6.0 (and above).\n\n### Workarounds\nCKEditor 5 recommends configuring General HTML Support securely to ensure that unsafe content is not accepted. Please refer to the [Security](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html#security) section for detailed guidance.\n\n### Credits\nCKEditor 5 would like to thank: \n- Emilio Kevin\n- Jeongwoo Lee, Younsoung Kim, Minseok Kim and Jinyeong Kim from ENKI Whitehat\n\nfor responsibly reporting this vulnerability.\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.",
  "id": "GHSA-jrqm-vmqc-gm93",
  "modified": "2026-03-19T18:45:07Z",
  "published": "2026-03-04T18:49:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28343"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ckeditor/ckeditor5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package"
}

FKIE_CVE-2026-28343

Vulnerability from fkie_nvd - Published: 2026-03-05 20:16 - Updated: 2026-03-19 19:16

Severity ?

6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0
security-advisories@github.com	https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0	Release Notes
security-advisories@github.com	https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93	Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	ckeditor	ckeditor5	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6ADE9D9-13BD-491C-8B46-0A3D45582F03",
              "versionEndExcluding": "47.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0."
    },
    {
      "lang": "es",
      "value": "CKEditor 5 es un editor de texto enriquecido moderno de JavaScript con una arquitectura MVC. Antes de la versi\u00f3n 47.6.0, se ha descubierto una vulnerabilidad de cross-site scripting (XSS) en la funci\u00f3n de Soporte HTML General. Esta vulnerabilidad podr\u00eda activarse mediante la inserci\u00f3n de marcado especialmente dise\u00f1ado, lo que llevar\u00eda a la ejecuci\u00f3n no autorizada de c\u00f3digo JavaScript, si la instancia del editor utilizaba una configuraci\u00f3n insegura de Soporte HTML General. Este problema se ha corregido en la versi\u00f3n 47.6.0."
    }
  ],
  "id": "CVE-2026-28343",
  "lastModified": "2026-03-19T19:16:20.003",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-05T20:16:16.017",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-28343 (GCVE-0-2026-28343)

GHSA-JRQM-VMQC-GM93

Impact

Patches

Workarounds

Credits

For more information

FKIE_CVE-2026-28343

Tags

Sightings

Nomenclature