Exposição de Discourse

Message boards
82
score de exposição
2.305
sites usam
0
em exploração
3
críticos
Análise Vexday

Com 248 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em produção. O tipo de falha mais recorrente é CWE-200 (exposição indevida de informações), indicando um padrão histórico de problemas relacionados ao controle de acesso a dados. A CVE mais perigosa no momento, CVE-2024-53991, registra EPSS de aproximadamente 0,25, valor que merece atenção dado que reflete probabilidade não trivial de exploração nos próximos 30 dias. O volume de 31 CVEs surgidas nos últimos 90 dias sinaliza cadência ativa de descobertas recentes, recomendando monitoramento contínuo do ciclo de atualização da plataforma.

CVEs

276 resultados
CVE-2026-33291MEDIUMDiscourse user can create Zendesk tickets even when it does not have access to topicEPSS 0.2%CVE-2026-53960MEDIUMDiscourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LDEPSS 0.2%CVE-2026-32113MEDIUMDiscourse: Open redirect via `sso_destination_url` cookie in `enter`EPSS 0.2%CVE-2026-33185MEDIUMDiscourse: Group SMTP test endpoint susceptible to SSRFEPSS 0.2%CVE-2026-44780MEDIUMDiscourse: Category queue reviewers can read raw incoming emails from queued postsEPSS 0.2%CVE-2026-44785MEDIUMDiscourse: Hidden reply-to post raw can be disclosed through AI explain promptsEPSS 0.2%CVE-2026-44782MEDIUMDiscourse: GroupPostSerializer leaks hidden full names through reaction post associationEPSS 0.2%CVE-2026-33415MEDIUMDiscourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content ExposureEPSS 0.2%CVE-2026-27166MEDIUMDiscourse vulnerable to HTML injection via prohibited iframe URLsEPSS 0.2%CVE-2026-72728MEDIUMDiscourse: Onebox iframe origin allowlist enforces URL authority boundaryEPSS 0.2%CVE-2025-66488MEDIUMDiscourse allows script execution in uploaded HTML/XML files on S3EPSS 0.2%CVE-2026-31869MEDIUMDiscourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` checkEPSS 0.2%CVE-2025-68479HIGHDiscourse subscriptions are susceptible to takeoverEPSS 0.2%CVE-2026-33073LOWdiscourse-subscriptions plugin leaking stripe API key in multisite environmentEPSS 0.2%CVE-2025-69289MEDIUMDiscourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email changeEPSS 0.2%CVE-2026-33074MEDIUMDiscourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptionsEPSS 0.2%CVE-2026-32243MEDIUMDiscourse: Stored XSS in discourse-ai shared conversations oneboxEPSS 0.2%CVE-2026-55704MEDIUMDiscourse: Shared-draft titles and excerpts leak through group post serializationEPSS 0.2%CVE-2026-26979NONEDiscourse: TL4 users are able to change status of restricted topicsEPSS 0.2%CVE-2026-32273MEDIUMDiscourse: XSS on category description update via APIEPSS 0.2%