Vulnerabilities in Discourse

308 results
Vexday analysis

Discourse apresenta uma vulnerabilidade catalogada na base, sem evidência de exploração ativa em campo (0 KEV). A fraqueza identificada é CWE-862 (falta de autorização), risco moderado típico de controle de acesso. O panorama é estável, sem publicações recentes que indiquem degradação da postura de segurança.

CVE-2024-53851MEDIUMPartial denial of service via inline oneboxes in DiscourseEPSS 0.5%CVE-2023-23615MEDIUMMalicious users in Discourse can create spam topics as any user due to improper access controlEPSS 0.5%CVE-2025-53102HIGHDiscourse's WebAuthn challenge isn't cleared from user session after authenticationEPSS 0.5%CVE-2023-25169LOWYearly Review Plugin leaking anonymised users data in discourse-yearly-reviewEPSS 0.4%CVE-2026-72721MEDIUMDiscourse: Onebox Domain Blocklist Bypass via Case-Sensitive ComparisonEPSS 0.4%CVE-2023-44384MEDIUMDiscourse-Jira could make SSRF attack by setting Jira URL to an arbitrary locationEPSS 0.4%CVE-2023-30611MEDIUMReaction metadata exposed in private topics in Discourse-reactionsEPSS 0.4%CVE-2023-32301LOWDiscourse's canonical url not being used for topic embeddingsEPSS 0.4%CVE-2024-54142CRITICALCross-site Scripting via Discourse-ai SharedAiConversation onebox in DiscourseEPSS 0.4%CVE-2024-24817MEDIUMUser can see invitees in events created in PMs and private categoriesEPSS 0.4%CVE-2024-36113MEDIUMDiscourse missing authorization checks for suspending admins/moderatorsEPSS 0.4%CVE-2022-39270MEDIUMArbitrary HTML injection in table-of-contents theme component in DiscoTOCEPSS 0.4%CVE-2022-39279MEDIUMDiscourse-chat plugin susceptible to XSS in channel name and descriptionEPSS 0.4%CVE-2023-43659HIGHCross-site Scripting via email preview when CSP disabled in DiscourseEPSS 0.4%CVE-2026-55424HIGHDiscourse: Topic featured link susceptible to stored XSSEPSS 0.4%CVE-2026-53962MEDIUMDiscourse: Insufficient SVG sanitization logicEPSS 0.4%CVE-2026-33355MEDIUMDiscourse filters whisper posts from private-posts feedEPSS 0.4%CVE-2021-39161MEDIUMCross-site scripting via category name in DiscourseEPSS 0.4%CVE-2024-23654MEDIUMdiscourse-ai admin-initiated SSRF when interacting with AI servicesEPSS 0.4%CVE-2023-44391MEDIUMPrevent unauthorized access to summary details in DiscourseEPSS 0.4%