Exposición de Discourse
Message boards82
score de exposición
2305
sitios usan
0
en explotación
3
críticos
Análisis Vexday
Com 248 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em produção. O tipo de falha mais recorrente é CWE-200 (exposição indevida de informações), indicando um padrão histórico de problemas relacionados ao controle de acesso a dados. A CVE mais perigosa no momento, CVE-2024-53991, registra EPSS de aproximadamente 0,25, valor que merece atenção dado que reflete probabilidade não trivial de exploração nos próximos 30 dias. O volume de 31 CVEs surgidas nos últimos 90 dias sinaliza cadência ativa de descobertas recentes, recomendando monitoramento contínuo do ciclo de atualização da plataforma.
CVEs
276 resultadosCVE-2022-23548MEDIUMDiscourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` andEPSS 0.7%CVE-2022-21642MEDIUMExposure of whisper participants in discourseEPSS 0.7%CVE-2025-48954HIGHDiscourse vulnerable to XSS via user-provided query parameter in oauth failure flowEPSS 0.7%CVE-2023-46130MEDIUMBypassing height value allowed in some theme componentsEPSS 0.7%CVE-2023-36818MEDIUMDenial of service via User Custom Sidebar Section Unlimited Link Creation in discourseEPSS 0.7%CVE-2023-38498MEDIUMDiscourse vulnerable to DoS via defer queueEPSS 0.7%CVE-2023-47121LOWDiscourse SSRF vulnerability in EmbeddingEPSS 0.7%CVE-2023-28440LOWDenial of service via admin theme import route in DiscourseEPSS 0.7%CVE-2023-22740MEDIUMDiscourse vulnerable to Allocation of Resources Without Limits via Chat draftsEPSS 0.7%CVE-2022-46177MEDIUMDiscourse password reset link can lead to in account takeover if user changes to a new emailEPSS 0.7%CVE-2023-23616LOWDiscourse membership requests lack character limitEPSS 0.7%CVE-2023-23620MEDIUMDiscourse restricted tag routes leak topic informationEPSS 0.7%CVE-2022-31184MEDIUMEmail activation route can be abused by spammers in DiscourseEPSS 0.7%CVE-2022-24850MEDIUMCategory group permissions leaked in DiscourseEPSS 0.7%CVE-2023-28107MEDIUMDiscourse vulnerable to multisite DoS by spamming backupsEPSS 0.7%CVE-2023-38684MEDIUMDiscourse vulnerable to ossible DDoS due to unbounded limits in various controller actionsEPSS 0.6%CVE-2026-45788MEDIUMDiscourse: Secure uploads exposed by hotlinked image copyingEPSS 0.6%CVE-2022-46159MEDIUMAny authenticated Discourse user can create an unlisted topicEPSS 0.6%CVE-2023-40588MEDIUMDiscourse DoS via 2FA and Security Key NamesEPSS 0.6%CVE-2023-41043MEDIUMDiscourse DoS via SvgSprite cacheEPSS 0.6%