Exposição de Discourse
Message boards82
score de exposição
2.305
sites usam
0
em exploração
3
críticos
Análise Vexday
Com 248 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em produção. O tipo de falha mais recorrente é CWE-200 (exposição indevida de informações), indicando um padrão histórico de problemas relacionados ao controle de acesso a dados. A CVE mais perigosa no momento, CVE-2024-53991, registra EPSS de aproximadamente 0,25, valor que merece atenção dado que reflete probabilidade não trivial de exploração nos próximos 30 dias. O volume de 31 CVEs surgidas nos últimos 90 dias sinaliza cadência ativa de descobertas recentes, recomendando monitoramento contínuo do ciclo de atualização da plataforma.
CVEs
276 resultadosCVE-2025-48877HIGHDiscourse vulnerable to auto-executing of third-party code in embedded CodePen iframeEPSS 0.4%CVE-2025-46813MEDIUMPrivate data leak on login-required Discourse sitesEPSS 0.4%CVE-2023-34250MEDIUMDiscourse vulnerable to exposure of number of topics recently created in private categoriesEPSS 0.4%CVE-2023-36466LOWTopic Title Validation Skipped When Changing Category in DiscourseEPSS 0.4%CVE-2023-36473MEDIUMCSP nonce reuse vulnerability in DiscourseEPSS 0.4%CVE-2023-30606MEDIUMMultisite denial of service through unsanitized dynamic dispatch to SiteSetting in DiscourseEPSS 0.4%CVE-2026-72723MEDIUMDiscourse: Anonymous sidebar serialization exposes descriptions of category-restricted tagsEPSS 0.4%CVE-2026-55674CRITICALDiscourse: Cache poisoning/XSS via color scheme cookiesEPSS 0.4%CVE-2025-49845MEDIUMDiscourse users are able to see their own whispers even after being removed from a group that has been configured to see whispersEPSS 0.4%CVE-2024-45051HIGHBypass of email address validation via encoded email addresses in DiscourseEPSS 0.4%CVE-2025-48053HIGHDiscourse vulnerable to DoS via large URL payload in PM to a botEPSS 0.4%CVE-2025-22601LOWClient Side Path Traversal using activate account route in DiscourseEPSS 0.4%CVE-2025-24972MEDIUMDiscourse may bypass user preference when adding users to chat groupsEPSS 0.4%CVE-2024-36122LOWDiscourse doesn't limit reviewable user serializer payloadEPSS 0.4%CVE-2023-37467MEDIUMDiscourse CSP nonce reuse vulnerability for anonymous usersEPSS 0.4%CVE-2024-37165MEDIUMDiscourse has an XSS via Onebox systemEPSS 0.4%CVE-2023-30538MEDIUMStored Cross-site Scripting via improper sanitization of svg files in DiscourseEPSS 0.4%CVE-2025-22602MEDIUMStored DOM-based XSS (without CSP) via video placeholders in DiscourseEPSS 0.4%CVE-2024-56328MEDIUMHTMLi(XSS without CSP) via Onebox urls in DiscourseEPSS 0.4%CVE-2023-32061MEDIUMDiscourse Topic Creation Page Allows iFrame Tag without RestrictionsEPSS 0.4%