In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-32099 was detected. This vulnerability allows authenticated users to access hidden profile information—such as bio, location, and website—through the user onebox preview, even when hide_profile is enabled. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32099.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-33355 was detected. This vulnerability allows regular participants in private message topics to view whisper posts via the `/private-posts` endpoint, bypassing intended post-type visibility restrictions. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33355.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a high severity vulnerability CVE-2026-33410 was detected. This vulnerability allows attackers to bypass authorization checks in the chat direct message API, potentially exposing private group member identities and message content by abusing improper validation of the target_groups parameter and insufficient checks on user chat settings. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33410.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-33393 was detected. This vulnerability allows attackers to bypass spam protection by exploiting improper domain boundary validation in the allowed_spam_host_domains check, enabling domains like attacker-example.com to circumvent restrictions when example.com was allowlisted. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33393.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a low severity vulnerability CVE-2026-33394 was detected. This vulnerability allows moderators to view the first 40 characters of raw post content from private messages and secure categories via the Post Edits admin report, bypassing intended access restrictions. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33394.
In aaPanel version 7.57.0 a high severity vulnerability CVE-2026-29856 was detected. This vulnerability allows attackers to cause a Regular Expression Denial of Service (ReDoS) via crafted input due to improper handling in the VirtualHost configuration parser component. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29856.
In aaPanel version 7.57.0 a critical severity vulnerability CVE-2026-29859 was detected. This vulnerability allows attackers to execute arbitrary code by uploading a crafted file through an arbitrary file upload flaw. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29859
In aaPanel version 7.57.0 a high severity vulnerability CVE-2026-29858 was detected. This vulnerability allows attackers to execute a local file inclusion (LFI) attack due to lack of path validation, potentially leading to sensitive information exposure. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29858.
In Vaultwarden versions prior to 1.35.4 a medium severity vulnerability CVE-2026-27898 was detected. This vulnerability allows authenticated users to access sensitive data from another user’s cipher by exploiting the “PUT /api/ciphers/{id}/partial” endpoint, which improperly returns cipher details despite access restrictions. To address this issue, users should upgrade Vaultwarden to version 1.35.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27898.