See SAP Note 2948317 – Vulnerabilities in open source libraries used in SAP Commerce:
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted “protected” comment (with the cke_protected syntax).
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution where unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.