CVE-2026-61696

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

EUVD-2026-61141

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-61696

Forem versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c render unsanitized feedback_message[message] via raw() in app/views/admin/feedback_messages/_feedback_message.html.erb, enabling stored XSS when an admin views an abuse report. The unauthenticated FeedbackMessagesController acc...

CVE-2026-61696 Forem: Stored XSS in Admin Abuse Report Rendering

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-61696 Forem: Stored XSS in Admin Abuse Report Rendering

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-61696 Forem: Stored XSS in Admin Abuse Report Rendering

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

PT-2026-77267

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback messagemessage is stored without sanitization and rendered in app/views/admin/feedback messages/ feedback message.html.erb throu...

CVE-2026-61696: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-48780

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

CVE-2026-48780

CVE-2026-48780 affects Forem. Before commit a2ab6d4, a maliciously crafted email address could bypass domain allowlist/denylist restrictions and gain access to invite-only Forem deployments. The issue is patched as of a2ab6d4. Affected component is the email validation/allowlist logic; impact is ...

CVE-2026-48780 Forem vulnerable to bypass of email address domain restrictions

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

EUVD-2026-37120

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

CVE-2026-48780 Forem vulnerable to bypass of email address domain restrictions

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

CVE-2026-48780 Forem vulnerable to bypass of email address domain restrictions

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

PT-2026-49717

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

CVE-2026-48780: Improper Authentication

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

EUVD-2023-30942

Malicious code in bioql PyPI...

CVE-2023-27160

forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery SSRF via the component /articles/id. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request...

CVE-2023-27160

forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery SSRF via the component /articles/id. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request...

CVE-2023-27160

forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery SSRF via the component /articles/id. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request...