https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T15:03:00.410134+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-discourse-2025-48877 BIT-discourse-2025-48877 — Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe 2026-10-05T15:03:00.446592+00:00

Affected: Bitnami: discourse

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, Codepen is present in the default `allowed_iframes` site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. As a workaround, the Codepen prefix can be removed from a site's `allowed_iframes`.

 https://cve.radiocsirt.org/vuln/euvd-2026-243471 EUVD-2026-243471 2026-10-05T15:03:00.446649+00:00 EUVD-2026-243471 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48877 fkie_cve-2025-48877 2026-10-05T15:03:00.446666+00:00

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, Codepen is present in the default `allowed_iframes` site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. As a workaround, the Codepen prefix can be removed from a site's `allowed_iframes`.