CVE-2026-33428 Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions...

CVE-2026-33428

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions...

CVE-2026-33428

Summary: Discourse allows a non-staff user with elevated group membership to access deleted posts from any user due to an overly broad authorization check on the deleted posts index endpoint. Affected versions: prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Root cause (as stated): overly bro...

EUVD-2026-13912

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions...

CVE-2026-33411

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a potential stored XSS in topic titles for the solved posts stream. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure that the Content Securi...

CVE-2026-33037

creationtimestamp| type| source ---|---|--- 2026-03-20 23:01:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjmopgk4k2c 2026-03-20 23:04:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjmu4qtlm2t 2026-03-23 23:40:09+00:00| seen|...

CVE-2026-33411

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a potential stored XSS in topic titles for the solved posts stream. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure that the Content Securi...

CVE-2026-33411

Discourse is affected by CVE-2026-33411, a stored XSS in topic titles for the solved posts stream. The issue exists in versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. A patch is available in 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Remediation guidance includes enabling a Content S...

CVE-2026-23536

creationtimestamp| type| source ---|---|--- 2026-03-20 22:17:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjkbeyx7p2k 2026-03-20 22:20:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjkggpsjk2c 2026-03-21 01:21:46+00:00| seen|...

CVE-2026-33172

creationtimestamp| type| source ---|---|--- 2026-03-20 22:17:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjkb7iabx2c 2026-03-20 22:18:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjkcc7x4y2u 2026-03-21 02:21:20+00:00| seen|...

CVE-2026-3584

creationtimestamp| type| source ---|---|--- 2026-03-20 22:17:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjkasbyac2n 2026-03-20 22:18:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjkbts2sw26 2026-03-21 02:25:48+00:00| seen|...

CVE-2026-33513

creationtimestamp| type| source ---|---|--- 2026-03-20 21:49:52+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-8fw8-q79c-fp9m 2026-03-23 19:23:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqrvqn5ef2e 2026-03-23 19:40:49+00:0...

CVE-2026-33512

creationtimestamp| type| source ---|---|--- 2026-03-20 21:45:54+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-mwjc-5j4x-r686 2026-03-23 19:23:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqrvjxw3h2u 2026-03-23 19:40:41+00:0...

CVE-2026-32710

creationtimestamp| type| source ---|---|--- 2026-03-20 20:20:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjdpvfhp62c 2026-03-20 21:47:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhjilfyatm2o 2026-03-25 14:57:06+00:00| seen|...

CVE-2026-32318

creationtimestamp| type| source ---|---|--- 2026-03-20 20:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjcmb4wdx2v 2026-03-20 21:56:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhjj3hi55q2o 2026-03-26 15:20:09+00:00| seen|...

CVE-2026-32317

creationtimestamp| type| source ---|---|--- 2026-03-20 20:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjcm2nym42t 2026-03-20 21:26:30+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhjhfdsqvp2u 2026-03-20 22:23:54+00:00| seen|...

Exploit for CVE-2025-11926

CVE-2025-11926 Wordpress-Re...

CVE-2026-33480

creationtimestamp| type| source ---|---|--- 2026-03-20 14:51:26+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-p3gr-g84w-g8hh 2026-03-20 14:51:26+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-p3gr-g84w-g8hh...

CVE-2026-33068

creationtimestamp| type| source ---|---|--- 2026-03-20 10:24:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhicf3hsr52e 2026-03-20 11:39:36+00:00| seen| https://bsky.app/profile/ai-nerd.bsky.social/post/3mhiglv5fdf2w 2026-03-20 18:24:32+00:00| seen|...

Discourse 跨站脚本漏洞

Discourse is an open-source community discussion platform developed by Discourse. This platform includes features such as communities, email communication, and chat rooms. Versions of Discourse prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contained a cross-site scripting vulnerability. This...