CVE-2026-55704 Discourse: Shared-draft titles and excerpts leak through group post serialization

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

CVE-2026-55704

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

EUVD-2026-60237

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

CVE-2026-55704

Discourse serializes shared-draft topics and posts through the group posts and group mentions endpoints regardless of draft-view permissions, leaking unpublished draft titles and content to any group-activity viewer. Affected versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are fixed ...

PT-2026-76682

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description Users permitted to view group activity but restricted from seeing shared drafts can...

CVE-2026-72722

Discourse (open‑source discussion platform) contains a vulnerability in TopicLink processing prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The affected components are TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup. The root cause is that Guardia...

CVE-2026-66915

creationtimestamp| type| source ---|---|--- 2026-08-10 10:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspvpwstsn2n 2026-08-10 10:53:53+00:00| seen| https://bsky.app/profile/mysites.guru/post/3mspwps54m32i 2026-08-11 09:04:48+00:00| seen|...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

EUVD-2026-55000

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-18934

CVE-2026-18934 affects the RSS Aggregator by Feedzy WordPress plugin up to version 5.2.5 (pre-5.2.6). The vulnerability arises because the plugin does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and ab...

CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

EUVD-2026-55013

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

EUVD-2026-55025

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-16257

The CVE-2026-16257 entry concerns the Arvow AI SEO Writer WordPress plugin (pre-1.5.4). The NVD/CVE descriptions indicate an access control flaw in a REST endpoint that can be reached without authentication due to type juggling when the plugin is not configured. This allows unauthenticated users ...

CVE-2026-19387

creationtimestamp| type| source ---|---|--- 2026-08-10 03:22:58+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117069065622079893 2026-08-10 04:00:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msp7loglun2y 2026-08-10 04:00:01+00:00| seen|...

CVE-2026-19348

creationtimestamp| type| source ---|---|--- 2026-08-09 12:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msnjxultsu2k 2026-08-09 12:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnjy52jnm23 2026-08-09 16:00:46+00:00| seen|...