Vulnerabilities in Discourse
323 resultsCVE-2023-23616LOWDiscourse membership requests lack character limitEPSS 0.7%CVE-2026-44787HIGHDiscourse: Signup-time primary_group_id assignment grants whisperer accessEPSS 0.7%CVE-2023-23620MEDIUMDiscourse restricted tag routes leak topic informationEPSS 0.7%CVE-2022-46159MEDIUMAny authenticated Discourse user can create an unlisted topicEPSS 0.7%CVE-2022-24850MEDIUMCategory group permissions leaked in DiscourseEPSS 0.7%CVE-2023-28107MEDIUMDiscourse vulnerable to multisite DoS by spamming backupsEPSS 0.7%CVE-2022-24866MEDIUMExposure of Sensitive Information to an Unauthorized Actor in Discourse AssignEPSS 0.7%CVE-2022-39241HIGHPossible Server-Side Request Forgery (SSRF) in webhooksEPSS 0.6%CVE-2023-44388HIGHMalicious requests can fill up the log files resulting in a deinal of service in DiscourseEPSS 0.6%CVE-2023-38684MEDIUMDiscourse vulnerable to ossible DDoS due to unbounded limits in various controller actionsEPSS 0.6%CVE-2026-45788MEDIUMDiscourse: Secure uploads exposed by hotlinked image copyingEPSS 0.6%CVE-2023-22453MEDIUMDiscourse vulnerable to exposure of user post counts per topic to unauthorized usersEPSS 0.6%CVE-2021-41263HIGHSecure/signed cookies share secrets between sites in rails_multisiteEPSS 0.6%CVE-2026-72724MEDIUMDiscourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID MismatchEPSS 0.6%CVE-2022-23549MEDIUMDiscourse vulnerable to bypass of post max_length using HTML commentsEPSS 0.6%CVE-2023-40588MEDIUMDiscourse DoS via 2FA and Security Key NamesEPSS 0.6%CVE-2023-41043MEDIUMDiscourse DoS via SvgSprite cacheEPSS 0.6%CVE-2023-22454HIGHDiscourse vulnerable to Cross-site Scripting through pending post titles descriptionsEPSS 0.6%CVE-2023-41042MEDIUMDiscourse DoS via remote theme assetsEPSS 0.6%CVE-2026-55420HIGHDiscourse: Remote code execution via pdf uploadsEPSS 0.6%