CVE-2026-39924 | Medium | 6.8 | 2026-08-05 | Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access… |
CVE-2026-39923 | High | 8.1 | 2026-08-05 | Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens b… |
CVE-2026-41887 | Medium | 4.9 | 2026-05-08 | Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri() LESS fea… |
CVE-2026-30913 | Medium | 4.6 | 2026-03-10 | Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients i… |
CVE-2024-58303 | | | 2025-12-11 | FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. A… |
CVE-2024-58302 | | | 2025-12-11 | FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Atta… |
CVE-2025-27794 | Medium | 6.8 | 2025-03-12 | Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain… |
CVE-2024-21641 | Medium | 6.5 | 2024-01-05 | Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third part… |
CVE-2023-40033 | High | 7.1 | 2023-08-16 | Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) at… |
CVE-2023-27577 | Medium | 6.6 | 2023-03-10 | flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may… |
CVE-2023-22489 | Low | 3.5 | 2023-01-13 | Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view… |
CVE-2023-22488 | Medium | 6.8 | 2023-01-12 | Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that wou… |
CVE-2023-22487 | High | 7.7 | 2023-01-11 | Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the… |
CVE-2022-41938 | Critical | 9.0 | 2022-11-19 | Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered… |
CVE-2021-32671 | Critical | 10.0 | 2021-06-07 | Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. T… |
CVE-2021-21283 | Medium | 5.4 | 2021-01-26 | Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vu… |
CVE-2019-13183 | High | 8.8 | 2019-07-07 | Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings. |
CVE-2019-11514 | High | 7.5 | 2019-04-25 | User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens. |
CVE-2018-19133 | Medium | 5.3 | 2018-11-09 | In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address. |