Vulnerabilidades em discourse

323 resultados
Análise Vexday

Com 278 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em comparação ao universo típico de produtos monitorados. Ainda assim, 31 vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descobertas recentes que exige acompanhamento contínuo. A falha mais prevalente é CWE-200 (exposição de informações sensíveis), padrão que tende a se manifestar em plataformas de comunicação e pode facilitar reconhecimento por parte de atacantes. A CVE mais perigosa ativa atualmente é CVE-2024-53991, com escore EPSS de 0,2543 — o mais alto observado no conjunto —, e entre as cinco vulnerabilidades críticas catalogadas quatro já contam com prova de conceito pública, o que eleva o risco de exploração para equipes que ainda não aplicaram as correções correspondentes.

CVE-2024-53991HIGHPotential Backup file leaked via Nginx in DiscourseEPSS 29.9%CVE-2021-41163CRITICALRCE via malicious SNS subscription payloadEPSS 19.8%CVE-2023-45131HIGHUnauthenticated access to new private chat messages in DiscourseEPSS 4.0%CVE-2026-28227LOWDiscourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_categoryEPSS 3.3%CVE-2022-36066CRITICALDiscourse vulnerable to RCE via admins uploading maliciously zipped fileEPSS 2.1%CVE-2021-43840MEDIUMPath traversal in message_busEPSS 1.9%CVE-2024-47773HIGHAnonymous cache poisoning via XHR requests in DiscourseEPSS 1.8%CVE-2021-41082HIGHPrivate message title and participating users leaked in discourseEPSS 1.8%CVE-2026-26265HIGHDiscourse has IDOR vulnerability in the directory items endpointEPSS 1.3%CVE-2022-39232MEDIUMDiscourse vulnerable to incomplete quote causing a topic to crash in the browserEPSS 1.2%CVE-2026-27934HIGHDiscourse leaks private topic title and post excerpt via user action API endpointEPSS 1.2%CVE-2022-46162HIGHDiscourse BBCode plugin vulnerable to arbitrary CSS injectionEPSS 1.2%CVE-2022-21677MEDIUMGroup advanced search option may leak group and group's members visibility EPSS 1.2%CVE-2022-23641MEDIUMDenial of Service in DiscourseEPSS 1.2%CVE-2022-31060MEDIUMBanner topic data is exposed on login-required Discourse sitesEPSS 1.1%CVE-2021-43794MEDIUMAnonymous user cache poisoning via development-mode header in DiscourseEPSS 1.1%CVE-2022-39226MEDIUMDiscourse user profile location and website fields were not sufficiently length-limitedEPSS 1.0%CVE-2022-24824MEDIUMAnonymous user cache poisoning in discourseEPSS 1.0%CVE-2022-31025LOWInvite bypasses user approval in DiscourseEPSS 1.0%CVE-2023-45806MEDIUMDiscourse vulnerable to DoS via Regexp Injection in Full NameEPSS 1.0%