EUVD-2026-86304

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91120

The open-source discussion platform Discourse contains a stored HTML injection vulnerability in its video notification email and chat summary generation. Prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 , provider-controlled video titles from lazy video embeds (YouTube, Vimeo, or TikT...