CVE-2026-91132

The open-source discussion platform Discourse contains a vulnerability in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . Sites utilizing wildcard patterns in the allowed_iframes setting are susceptible to a bypass where a crafted iframe URL places an allowlisted suffix after a URL...

Vanilla: Stored XSS in vanilla

Summary: There is a stored XSS in the latest version 2.8 of vanilla. Attack with post privileges can trigger this. Description: In last report 481360, I found a XSS cause by Format. But in lastest version 2.8, the default Format of Discussion and Comment is Rich. In this Format, we can insert a...

Vanilla: Stored XSS in vanilla

Summary: There is a stored XSS in the latest version 2.6.4 of vanilla. Attack with post privileges can trigger this. Description: This is a feature that user can post content in markdown format. And the content and format type is inserted into database without check the format param. So attack ca...