Exposição de Discourse
Message boards87
score de exposição
2.279
sites usam
0
em exploração
3
críticos
Análise Vexday
Com 248 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em produção. O tipo de falha mais recorrente é CWE-200 (exposição indevida de informações), indicando um padrão histórico de problemas relacionados ao controle de acesso a dados. A CVE mais perigosa no momento, CVE-2024-53991, registra EPSS de aproximadamente 0,25, valor que merece atenção dado que reflete probabilidade não trivial de exploração nos próximos 30 dias. O volume de 31 CVEs surgidas nos últimos 90 dias sinaliza cadência ativa de descobertas recentes, recomendando monitoramento contínuo do ciclo de atualização da plataforma.
CVEs
290 resultadosCVE-2024-53851MEDIUMPartial denial of service via inline oneboxes in DiscourseEPSS 0.5%CVE-2026-72726MEDIUMDiscourse: Unauthorized eavesdropping on private AI bot conversations.EPSS 0.5%CVE-2023-23615MEDIUMMalicious users in Discourse can create spam topics as any user due to improper access controlEPSS 0.5%CVE-2026-72722MEDIUMDiscourse: Duplicate lookup reveals restricted topic titles through canonicalized URLsEPSS 0.4%CVE-2026-72730HIGHDiscourse: Stored XSS chat-transcript username unescaped in Rich Text EditorEPSS 0.4%CVE-2026-33355MEDIUMDiscourse filters whisper posts from private-posts feedEPSS 0.4%CVE-2023-32301LOWDiscourse's canonical url not being used for topic embeddingsEPSS 0.4%CVE-2025-46813MEDIUMPrivate data leak on login-required Discourse sitesEPSS 0.4%CVE-2024-36113MEDIUMDiscourse missing authorization checks for suspending admins/moderatorsEPSS 0.4%CVE-2026-91159HIGHDiscourse: Stored oEmbed HTML injection via allowed iframeEPSS 0.4%CVE-2026-55424HIGHDiscourse: Topic featured link susceptible to stored XSSEPSS 0.4%CVE-2026-53962MEDIUMDiscourse: Insufficient SVG sanitization logicEPSS 0.4%CVE-2021-39161MEDIUMCross-site scripting via category name in DiscourseEPSS 0.4%CVE-2025-48877HIGHDiscourse vulnerable to auto-executing of third-party code in embedded CodePen iframeEPSS 0.4%CVE-2026-72720MEDIUMDiscourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsingEPSS 0.4%CVE-2026-72731HIGHDiscourse: Strip SQL comments and use non-recursive parameter interpolation in Data ExplorerEPSS 0.4%CVE-2025-49845MEDIUMDiscourse users are able to see their own whispers even after being removed from a group that has been configured to see whispersEPSS 0.4%CVE-2023-34250MEDIUMDiscourse vulnerable to exposure of number of topics recently created in private categoriesEPSS 0.4%CVE-2023-36466LOWTopic Title Validation Skipped When Changing Category in DiscourseEPSS 0.4%CVE-2023-36473MEDIUMCSP nonce reuse vulnerability in DiscourseEPSS 0.4%