Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:11:48 +0000 BIT-discourse-2026-27166 — Discourse vulnerable to HTML injection via prohibited iframe URLs https://cve.radiocsirt.org/vuln/bit-discourse-2026-27166 <p><strong>Affected:</strong> Bitnami: discourse</p> <p>Discourse is an open source discussion platform. Prior to versions 2026.3.0, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.</p> <p><strong>Affected:</strong> Bitnami: discourse</p> <p>Discourse is an open source discussion platform. Prior to versions 2026.3.0, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.</p> https://cve.radiocsirt.org/vuln/bit-discourse-2026-27166 EUVD-2026-276811 https://cve.radiocsirt.org/vuln/euvd-2026-276811 EUVD-2026-276811 https://cve.radiocsirt.org/vuln/euvd-2026-276811 fkie_cve-2026-27166 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27166 <p>Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.</p> <p>Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27166