CVE Tools
Track your stack

Flarum

3 CVEs tracked since 2023. Since Jan 2023, none of them reached CISA KEV.

Flarum CVEs per month

Jan 2023 to Jan 2023. Point at a month, or focus the strip and use the arrow keys.
Flarum CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2023-0130

Products

The products that kept showing up in Flarum's monthly top three, with their CVEs summed over those months.

  1. Flarum31 month
  2. Framework31 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Flarum.

  1. CVE-2026-39924Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation6.8
  2. CVE-2026-39923Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset8.1
  3. CVE-2026-41887Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)4.9
  4. CVE-2026-30913flarum/nickname: Display name injection in notification emails (autolink & markdown)4.6
  5. CVE-2024-58303FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings—
  6. CVE-2024-58302FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings—
  7. CVE-2025-27794Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite6.8
  8. CVE-2024-21641Flarum's Logout Route allows open redirects6.5
  9. CVE-2023-40033Server-Side Request Forgery via Avatar upload in flarum7.1
  10. CVE-2023-27577Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum6.6
  11. CVE-2023-22489Flarum is missing authorization in discussion replies3.5
  12. CVE-2023-22488Missing authorization in Flarum6.8
  13. CVE-2023-22487Post mentions can be used to read any post on the forum without access control7.7
  14. CVE-2022-41938Cross site scripting vulnerability with discussion titles in flarum9.0
  15. CVE-2021-32671XSS vulnerability with translator10.0

The record

Peak rank
#173 in Jan 2023
Busiest month shown
Jan 2023, 3 CVEs
Months with a KEV entry
0 since Jan 2023
Monthly snapshots
1 since 2023
Flarum's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store