We're way behind with this announcement, but back in October we released JForum 2.8.3, which had the following improvements:
fix problem when using Oracle as database
use system-wide date format in the user profile for the registration date
fixed a couple of bugs in the mail sending code
made a couple of changes for Wildfly compatibility
fix Commons FileUpload vulnerability
added Admin Config option to disable private messages
fixed another XSS vulnerability
A full list of new features is at
https://sourceforge.net/p/jforum2/wiki2/NewFeatures283/, upgrade instructions are at
https://sourceforge.net/p/jforum2/wiki2/UpgradingFrom282to283/ and you can download it from
https://sourceforge.net/projects/jforum2/files/. The documentation is at
https://sourceforge.net/p/jforum2/wiki2/Documentation/
All feedback is welcome.