CVE-2026-72721

Findings: CVE-2026-72721 affects Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The root cause is a case-sensitive comparison in Onebox::DomainChecker.is_blocked?, which compares hostnames and SiteSetting.blocked_onebox_domains entries. This allows an attacker to bypass c...

CVE-2026-63088

stoatchat before 0.14.0 contains a server-side request forgery SSRF vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the urlisblacklisted function, which inspects only the first resolved...