https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T09:30:28.941872+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2023-25169 CVE-2023-25169 — Yearly Review Plugin leaking anonymised users data in discourse-yearly-review 2026-10-22T09:30:28.943191+00:00

Affected: discourse-yearly-review

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit `b3ab33bbf7` which is included in the latest version of the Discourse Yearly Review plugin. Users are advised to upgrade. Users unable to upgrade may disable the `yearly_review_enabled` setting to fully mitigate the issue. Also, it's possible to edit the anonymised user's old data in the yearly review topics manually.