11.3.0

DATE	CVE	VULNERABILITY TITLE	RISK
2021-01-26	CVE-2021-26272	Inclusion of Functionality from Untrusted Control Sphere vulnerability in multiple products It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin). network low complexity ckeditor oracle CWE-829	6.5
2020-11-12	CVE-2020-27193	Cross-site Scripting vulnerability in multiple products A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs. network low complexity ckeditor oracle CWE-79	6.1