CVE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

EUVD-2026-86297

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

CVE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

CVE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

CVE-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

CLEANSTART-2026-LY26617 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the helm-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-JR87567 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the fluent-operator package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

MGASA-2026-0446 Updated xdg-dbus-proxy packages fix security vulnerabilities

filtering for broadcast messages bypassing path/interface/member checks...

Updated xdg-dbus-proxy packages fix security vulnerabilities

filtering for broadcast messages bypassing path/interface/member checks...

PT-2026-105619

filtering for broadcast messages bypassing path/interface/member checks...

PT-2026-105235

Security vulnerability affects the fluent-operator package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

PT-2026-105237

Security vulnerability affects the helm-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CVE-2026-84302: Missing Authorization

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

PT-2026-98146

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description AI reviewables associated with private messages may appear in the moderator review...

SUSE CVE-2026-95337

UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-95337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Messages. CVE-2026-95337 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable...

PT-2026-97365

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote attacker can obtain sensitive information when the system returns detailed technical error messages in the browser. This exposure of internal data could be leveraged to facilitate...

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

GHSA-HRMJ-7RVJ-4HG8 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...