CVE-2026-91132

The open-source discussion platform Discourse contains a vulnerability in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . Sites utilizing wildcard patterns in the allowed_iframes setting are susceptible to a bypass where a crafted iframe URL places an allowlisted suffix after a URL...