Security coverage of Discourse, the open-source discussion platform — vulnerability advisories, patch releases, and CVE tracking for one of the most widely deployed community forum platforms on the internet. Combined article + CVE feed for the Discourse beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-08-17-discourse-cve-2026-55674-csp-bypass/https://0daynews.com/articles/2026-08-17-discourse-cve-2026-55674-csp-bypass/Discourse patched CVSS 9.3 HTML injection bypassing nonce-CSP plus three info-disclosure flaws. Update: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.Mon, 17 Aug 2026 20:00:00 GMTDiscoursearticlehttps://0daynews.com/cve/cve-2026-55674/https://0daynews.com/cve/cve-2026-55674/In Discourse before 2026.7.0, a crafted cookie injects arbitrary HTML and bypasses nonce-based CSP, enabling unauthenticated XSS. CVSS 9.3 critical.Mon, 17 Aug 2026 00:00:00 GMTDiscoursecriticalcve