https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:58:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-233407 EUVD-2026-233407 https://cve.radiocsirt.org/vuln/euvd-2026-233407 https://cve.radiocsirt.org/vuln/fkie_cve-2022-41938 <p>Flarum is an open source discussion platform. Flarum&#39;s page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted. The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2. There are no known workarounds for this issue.</p> <p>Flarum is an open source discussion platform. Flarum&#39;s page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted. The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2. There are no known workarounds for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-41938 https://cve.radiocsirt.org/vuln/ghsa-7x4w-j98p-854x <p><strong>Affected:</strong> Packagist: flarum/core</p> <p>Flarum&#39;s page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed.</p> <p>This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page.</p> <p>### Impact All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted.</p> <p>### Patches The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2 using:</p> <p>``` composer update --prefer-dist --no-dev -a -W ```</p> <p>You can then confirm you run the latest version using:</p> <p>``` composer show flarum/core ```</p> <p>### Workarounds **None**</p> <p>### For more information For any questions or comments on this vulnerability please visit https://discuss.flarum.org/d/27558.</p> <p>For support questions create a discussion at https://discuss.flarum.org/t/support.</p> <p>A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.</p> <p><strong>Affected:</strong> Packagist: flarum/core</p> <p>Flarum&#39;s page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed.</p> <p>This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page.</p> <p>### Impact All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted.</p> <p>### Patches The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2 using:</p> <p>``` composer update --prefer-dist --no-dev -a -W ```</p> <p>You can then confirm you run the latest version using:</p> <p>``` composer show flarum/core ```</p> <p>### Workarounds **None**</p> <p>### For more information For any questions or comments on this vulnerability please visit https://discuss.flarum.org/d/27558.</p> <p>For support questions create a discussion at https://discuss.flarum.org/t/support.</p> <p>A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.</p> https://cve.radiocsirt.org/vuln/ghsa-7x4w-j98p-854x https://cve.radiocsirt.org/vuln/gsd-2022-41938 gsd-2022-41938 https://cve.radiocsirt.org/vuln/gsd-2022-41938