Exposure of Discourse

Message boards
82
exposure score
2,305
sites use
0
exploited
3
critical
Vexday analysis

Com 248 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em produção. O tipo de falha mais recorrente é CWE-200 (exposição indevida de informações), indicando um padrão histórico de problemas relacionados ao controle de acesso a dados. A CVE mais perigosa no momento, CVE-2024-53991, registra EPSS de aproximadamente 0,25, valor que merece atenção dado que reflete probabilidade não trivial de exploração nos próximos 30 dias. O volume de 31 CVEs surgidas nos últimos 90 dias sinaliza cadência ativa de descobertas recentes, recomendando monitoramento contínuo do ciclo de atualização da plataforma.

CVEs

276 results
CVE-2026-33251MEDIUMDiscourse has a Hidden Solved topics permission bypassEPSS 0.2%CVE-2026-32619MEDIUMDiscourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categoriesEPSS 0.2%CVE-2026-33426LOWDiscourse users can edit or synonymize hidden tags they can't seeEPSS 0.2%CVE-2026-27152LOWDIscourse has DM communication-preference bypass when adding membersEPSS 0.2%CVE-2026-27153LOWDiscourse doesn't prevent moderators from exporting user Chat DMsEPSS 0.2%CVE-2026-33410MEDIUMDiscourse hardens chat DM channel creation and expansionEPSS 0.2%CVE-2026-32607LOWDiscourse: Stored XSS via unescaped assignee nameEPSS 0.2%CVE-2026-27151LOWDiscourse doesn't validate destination topic when moving postsEPSS 0.2%CVE-2026-32615MEDIUMDiscourse: Category group moderators can perform actions on topics in restricted categories without read accessEPSS 0.2%CVE-2026-27154LOWDiscourse has XSS when editing a malicious postEPSS 0.2%CVE-2026-27150LOWDiscourse doesn't ensure guardian check when creating QueryGroupBookmarkEPSS 0.2%CVE-2026-26973MEDIUMDiscourse doesn't scope reviewable notes to user-visible reviewablesEPSS 0.2%CVE-2026-26207MEDIUMDIscourse's discourse-policy plugin lacks post access checkEPSS 0.2%CVE-2026-28218MEDIUMDiscourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query ExecutionEPSS 0.2%CVE-2026-44783MEDIUMDiscourse: Replying to a whisper lets non-whisperers create staff-only whisper postsEPSS 0.1%CVE-2025-68933MEDIUMDiscourse non-admin moderators can exfiltrate private content via post ownership transferEPSS 0.1%