CVE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user wi...

EUVD-2026-36557

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user wi...

CVE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user wi...

CVE-2026-44782 Discourse: GroupPostSerializer leaks hidden full names through reaction post association

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer declared includeuserlongname? as the predicate for its :name attribute, but AMS looks for includename?...

CVE-2026-44782 Discourse: GroupPostSerializer leaks hidden full names through reaction post association

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer declared includeuserlongname? as the predicate for its :name attribute, but AMS looks for includename?...

CVE-2026-44782

Discourse (open-source) is affected. In versions 2026.1.0-latest–2026.1.3.x, 2026.3.0-latest–2026.3.0.x, and 2026.4.0-latest–2026.4.0.x, GroupPostSerializer used include_user_long_name? as the predicate for the :name attribute. AMS checks for include_name?, but the misnamed predicate was never in...

CVE-2026-44782 Discourse: GroupPostSerializer leaks hidden full names through reaction post association

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer declared includeuserlongname? as the predicate for its :name attribute, but AMS looks for includename?...

EUVD-2026-36584

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, ReviewableQueuedPostSerializer unconditionally included payload"rawemail" for posts that arrived via incoming email...

aetherion

/\ | | | | | |...

CVE-2026-9125

creationtimestamp| type| source ---|---|--- 2026-06-12 19:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mo4hbjlgnz27...

MAL-2026-5703 Malicious code in eslint-plugin-mistica-local-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d21f50741178986b63d1f330373131c2f3f502a5b94e76ca921ce185fab123 package.json declares a preinstall hook that runs index.js automatically on npm install. index.js collects host identity os.hostname, os.platform,...

CVE-2026-53982

creationtimestamp| type| source ---|---|--- 2026-06-12 18:44:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4fikpduf2f...

EUVD-2026-36536

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...

CVE-2026-10715 Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...

CVE-2026-10715 Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...

CVE-2026-45832

creationtimestamp| type| source ---|---|--- 2026-06-12 18:16:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4dwdinmm2f...

CVE-2026-8828

creationtimestamp| type| source ---|---|--- 2026-06-12 18:12:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4dqedpsk2j...

CVE-2026-45833

creationtimestamp| type| source ---|---|--- 2026-06-12 18:04:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4dbluklu2x...

CVE-2026-12143

creationtimestamp| type| source ---|---|--- 2026-06-12 18:00:49+00:00| published-proof-of-concept| https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx 2026-06-12 21:57:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4qbo7oof23 2026-06-16 12:01:29+00:0...

CVE-2026-50090

creationtimestamp| type| source ---|---|--- 2026-06-12 17:46:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4cbmj3rq22 2026-06-13 10:30:34+00:00| seen| https://bsky.app/profile/michaelharley.net/post/3mo62ea7zms2p...