https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T19:58:55.213711+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-discourse-2025-48062 BIT-discourse-2025-48062 — Discourse vulnerable to HTML injection when inviting to topic via email 2026-10-10T19:58:55.217380+00:00

Affected: Bitnami: discourse

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. This can be worked around if the relevant templates are overridden without `{topic_title}`.

 https://cve.radiocsirt.org/vuln/euvd-2026-243353 EUVD-2026-243353 2026-10-10T19:58:55.217435+00:00 EUVD-2026-243353 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48062 fkie_cve-2025-48062 2026-10-10T19:58:55.217452+00:00

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. This can be worked around if the relevant templates are overridden without `{topic_title}`.