CVE-2026-65842 debrief based on the supplied source corpus. The Plate rich-text editor, specifically the @platejs/docx-io library, is vulnerable to server-side request forgery with response disclosure. This issue allows attackers to make requests to internal network resources and include the fetched image bytes in the generated DOCX, potentially leading to server-side request forgery with response disclos [truncated]
CVE-2026-55596 is a vulnerability in the Plate rich-text editor with AI and shadcn/ui. From version 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation. This allows a crafted Plate document to set a known video provider while keeping the URL as a javascript: iframe source that the registry MediaEmbedEle [truncated]
