Exposição de Discourse

Message boards
87
score de exposição
2.279
sites usam
0
em exploração
3
críticos
Análise Vexday

Com 248 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em produção. O tipo de falha mais recorrente é CWE-200 (exposição indevida de informações), indicando um padrão histórico de problemas relacionados ao controle de acesso a dados. A CVE mais perigosa no momento, CVE-2024-53991, registra EPSS de aproximadamente 0,25, valor que merece atenção dado que reflete probabilidade não trivial de exploração nos próximos 30 dias. O volume de 31 CVEs surgidas nos últimos 90 dias sinaliza cadência ativa de descobertas recentes, recomendando monitoramento contínuo do ciclo de atualização da plataforma.

CVEs

290 resultados
CVE-2025-68659MEDIUMDiscourse has DoS vulnerability in username change endpointEPSS 0.3%CVE-2026-33514MEDIUMDiscourse: Information Disclosure in Form Template API Due to Missing AuthorizationEPSS 0.3%CVE-2026-29072HIGHDiscourse missing permission check for policy creation in discourse-policyEPSS 0.2%CVE-2026-31805MEDIUMDiscourse has a poll authorization bypass via post_id array parameterEPSS 0.2%CVE-2026-33300MEDIUMDiscourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpointEPSS 0.2%CVE-2026-32143MEDIUMDiscourse: Admin-only report can be exported by moderatorsEPSS 0.2%CVE-2025-68660MEDIUMDiscourse AI Discover's continue conversation allows threat actor to impersonate userEPSS 0.2%CVE-2026-27481MEDIUMDiscourse: Hidden tag visibility bypass on tag routesEPSS 0.2%CVE-2026-30891MEDIUMDiscourse hasUnauthorized Exposure of Private User Action TypesEPSS 0.2%CVE-2026-84302MEDIUMDiscourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewablesEPSS 0.2%CVE-2026-30888LOWDiscourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpointEPSS 0.2%CVE-2026-44779MEDIUMDiscourse: Bot debug endpoints disclose whisper translation audit logsEPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2026-44784MEDIUMDiscourse: Non-staff group owners can see email password in plaintext through group historyEPSS 0.2%CVE-2026-28219LOWPrivilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global BannersEPSS 0.2%CVE-2026-33395MEDIUMDiscourse has stored click‑based XSS via Graphviz SVG javascript: linksEPSS 0.2%CVE-2026-32114MEDIUMDiscourse's unscoped status lookups leak restricted metadataEPSS 0.2%CVE-2026-33427LOWDiscourse Authorization Page Displays Unvalidated Redirect DomainEPSS 0.2%CVE-2026-34947LOWDiscourse: Staged user custom fields are exposed on public invite pagesEPSS 0.2%CVE-2025-24808MEDIUMDiscourse has race condition when adding users to a group DMEPSS 0.2%