CVE-2026-116675
No KEV entry is attached to this observation; this is not evidence that exploitation is absent.
FIRST EPSS: 0.35 % · percentile 28.48 % · scored 30 Oct 2026.
Observed 31 Oct 2026 01:52:30 UTC · Complete immutable risk JSON
CVE-2026-116675Published
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
Collected exploitation and prediction evidence
Risk source coverageCISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
Dated risk observations
Risk history is separate from CNA/OSV content history. Daily score drift is retained but only an upward crossing of 10% triggers the prediction change event.
CVE-2026-116675 · 31 Oct 2026 01:52:30 UTC
CVE-2026-116675 · 29 Oct 2026 18:29:26 UTC
Immutable source observations
7 recorded revisionsEach citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.
30 Oct 2026 02:00:12 UTC
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute maliciou…
euvd · EUVD-2026-111106 · Published
29 Oct 2026 21:50:49 UTC
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute maliciou…
nvd · CVE-2026-116675 · Published
28 Oct 2026 17:46:48 UTC
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
cve-program · CVE-2026-116675 · Published
28 Oct 2026 00:56:47 UTC
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute maliciou…
euvd · EUVD-2026-111106 · Published
27 Oct 2026 21:49:07 UTC
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute maliciou…
nvd · CVE-2026-116675 · Published
27 Oct 2026 21:46:19 UTC
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
osv · GHSA-mf2p-h6hf-fcwm · Published
27 Oct 2026 17:43:43 UTC
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
cve-program · CVE-2026-116675 · Published