F
Vendor security profile
Flarum
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs3
Critical1
CISA KEV0
Public exploit0
Patch rate%67
Avg. CVSS8.5
12-month vulnerability rate
0
1
0
0
0
0
0
0
0
2
0
0
CVE KEV
CVE severity distribution
3toplam CVE
Critical1 (33%)
High2 (67%)
Patch and exploitation view
%67
Verified patch
%0
CISA KEV
%0
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
1Unknown
Latest vulnerabilities
9.8
CVE-2026-92161
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
F
Patch status unknownEPSS %0
7.6
CVE-2026-39924
Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation
F
Patch verifiedEPSS %0
9.2
CVE-2026-39923
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
F
Patch verifiedEPSS %0
8.6
CVE-2024-58303
FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings
F
Patch status unknownEPSS %1