CVE-2026-61696 is a stored XSS vulnerability in Forem versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c. The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser through the feedback message system. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c. Administrators and users of Forem communities should assess expos [truncated]
CVE-2026-48780 is a HIGH severity vulnerability in Forem community software. A maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only Forem deployments. The issue was patched in commit [a2ab6d4](resourceLinkAnnotations:ref-4). As a workaround, some SMTP servers and email delivery providers may drop or refuse to send mali [truncated]
