Communication and Collaboration

In Discourse versions from 1.9.0.beta2 prior to 1.9.0.beta13 a medium severity vulnerability CVE-2017-20290 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in a victim’s browser via a Reflected Cross-Site Scripting (XSS) attack. This occurs due to the lack of proper sanitization of the email parameter on the /email/unsubscribed endpoint. Because the unsubscribed.html.erb template renders this input unescaped using the html_safe method, an attacker can craft a malicious GET request (for example, containing an SVG onload payload). If a victim visits the crafted link, the malicious script will be executed within the context of their session. Note: Active exploitation of this vulnerability has been observed in the wild. To address this issue, users should upgrade Discourse to version 1.9.0.beta13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2017-20290.

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91159 was detected. This vulnerability allows an authenticated attacker to inject stored visual overlays or misleading user interfaces into post content, potentially leading to fraudulent interactions. This occurs due to a flaw in oEmbed processing, which improperly treats an entire attacker-controlled HTML fragment as trusted as long as it contains an iframe whose source matches the configured allowlist. By controlling a public webpage and its oEmbed response, an attacker with posting permissions can combine an allowlisted iframe with malicious sibling HTML or CSS. While this issue compromises content integrity, it does not expose restricted data or disrupt availability. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91159.

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91156 was detected. This vulnerability allows an authenticated user to receive live and recent chat messages from a read-restricted category, leading to unauthorized information disclosure. This occurs due to a flaw in the MessageBus audience calculation. The publication path bounded events solely by category visibility without enforcing the site’s group restrictions for Chat eligibility. Consequently, users who were permitted to view the category but explicitly denied access to Chat could still intercept live message content exposed in the MessageBus backlog. Note that this issue does not permit retrieval of the channel’s full history through the Chat API, nor does it allow message creation or modification. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91156.

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91157 was detected. This vulnerability allows anonymous users to access restricted media and attachments, leading to unauthorized information disclosure. This occurs because sites with secure uploads enabled fail to reconcile existing upload security metadata when a previously public category becomes read-restricted, or when category permissions are modified during a bulk import. As a result, media and attachments uploaded while the category was public retain a public accessibility flag. These files remain reachable by anonymous users through their short upload URLs, even if the associated topics have been deleted. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91157.

In CryptPad versions from 2025.3.1 before 2026.2.2 a high severity vulnerability CVE-2025-51846 was detected. This vulnerability allows a remote, unauthenticated attacker to significantly degrade or completely deny service for all users of a CryptPad instance, leading to a Denial of Service (DoS). This occurs due to an unbounded WebSocket frame flood flaw, where the server fails to properly limit or throttle the rate and volume of incoming WebSocket frames. By sending a continuous, massive number of frames, an attacker can overwhelm the server’s resources and disrupt application availability. To address this issue, users should upgrade CryptPad to version 2026.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-51846.

In Mattermost versions 11.10.1 and earlier, 11.9.1 and earlier, 11.8.5 and earlier, and 11.7.10 and earlier a medium severity vulnerability CVE-2026-95666 was detected. This vulnerability allows an authenticated user to cause excessive database load. To address this issue, users should upgrade Mattermost to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-95666.

In Mattermost versions 6.2.2.0 and earlier a low severity vulnerability CVE-2026-12284 was detected. This vulnerability allows a malicious server to disconnect a user’s active call. To address this issue, users should upgrade Mattermost to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12284.

In Open Notebook versions before 1.11.0 a high severity vulnerability CVE-2026-90769 was detected. This vulnerability allows authenticated users to perform server-side requests to internal services. To address this issue, users should upgrade Open Notebook to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-90769.

In Mattermost versions 11.7.6 and earlier, and 10.11.21 and earlier a medium severity vulnerability CVE-2026-16046 was detected. This vulnerability allows a run participant to modify the details of completed playbook runs. To address this issue, users should upgrade Mattermost to version 10.11.22 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16046.