Vulnerabilities in discourse
323 resultsCVE-2024-37299MEDIUMDiscourse vulnerable to DoS via Tag GroupEPSS 0.6%CVE-2022-39378MEDIUMDisplaying user badges can leak topic titles to users that have no access to the topicEPSS 0.6%CVE-2024-24827MEDIUMNo rate limits on POST /uploads endpoint in DiscourseEPSS 0.6%CVE-2023-43658HIGHImproper escaping of user input in discourse-calendarEPSS 0.6%CVE-2024-35227HIGHDiscourse vulnerable to DoS through OneboxEPSS 0.6%CVE-2023-23624MEDIUMDiscourse's exclude_tags param could leak which topics had a specific hidden tagEPSS 0.6%CVE-2026-55674CRITICALDiscourse: Cache poisoning/XSS via color scheme cookiesEPSS 0.6%CVE-2022-46150MEDIUMDiscourse may allow exposure of hidden tags in the subject of notification emailsEPSS 0.6%CVE-2023-43657HIGHImproper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configurationEPSS 0.6%CVE-2026-72721MEDIUMDiscourse: Onebox Domain Blocklist Bypass via Case-Sensitive ComparisonEPSS 0.6%CVE-2021-41095MEDIUMXSS via blocked watched word in error messageEPSS 0.6%CVE-2022-31095MEDIUMExposure of Sensitive Information in discourse-chatEPSS 0.6%CVE-2023-28112MEDIUMDiscourse's SSRF protection missing for some FastImage requestsEPSS 0.6%CVE-2022-41921LOWDiscourse chat messages should have a maximum character limitEPSS 0.6%CVE-2024-27085MEDIUMDenial of service through invites in DiscourseEPSS 0.6%CVE-2022-46168LOWGroup SMTP user emails are exposed in CC email headerEPSS 0.6%CVE-2023-25167MEDIUMRegular expression denial of service via installing themes via git in discourseEPSS 0.6%CVE-2024-21655MEDIUMInsufficient control of custom field value sizesEPSS 0.6%CVE-2022-39385MEDIUMUsers erroneously and transparently added to private messages in DiscourseEPSS 0.6%CVE-2024-27100MEDIUMDenial of service via Staff Actions in DiscourseEPSS 0.6%