We're way behind with this announcement, but back in October we released JForum 2.8.3, which had the following improvements:

fix problem when using Oracle as database

use system-wide date format in the user profile for the registration date

fixed a couple of bugs in the mail sending code

made a couple of changes for Wildfly compatibility

fix Commons FileUpload vulnerability

added Admin Config option to disable private messages

fixed another XSS vulnerability

A full list of new features is at https://sourceforge.net/p/jforum2/wiki2/NewFeatures283/, upgrade instructions are at https://sourceforge.net/p/jforum2/wiki2/UpgradingFrom282to283/ and you can download it from https://sourceforge.net/projects/jforum2/files/. The documentation is at https://sourceforge.net/p/jforum2/wiki2/Documentation/

All feedback is welcome.