Vulnerabilidades em discourse

323 resultados
Análise Vexday

Com 278 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em comparação ao universo típico de produtos monitorados. Ainda assim, 31 vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descobertas recentes que exige acompanhamento contínuo. A falha mais prevalente é CWE-200 (exposição de informações sensíveis), padrão que tende a se manifestar em plataformas de comunicação e pode facilitar reconhecimento por parte de atacantes. A CVE mais perigosa ativa atualmente é CVE-2024-53991, com escore EPSS de 0,2543 — o mais alto observado no conjunto —, e entre as cinco vulnerabilidades críticas catalogadas quatro já contam com prova de conceito pública, o que eleva o risco de exploração para equipes que ainda não aplicaram as correções correspondentes.

CVE-2025-22602MEDIUMStored DOM-based XSS (without CSP) via video placeholders in DiscourseEPSS 0.4%CVE-2024-21658MEDIUMInsufficient control of region value length in discourse-calendarEPSS 0.4%CVE-2024-56328MEDIUMHTMLi(XSS without CSP) via Onebox urls in DiscourseEPSS 0.4%CVE-2023-32061MEDIUMDiscourse Topic Creation Page Allows iFrame Tag without RestrictionsEPSS 0.4%CVE-2024-56197LOWUsers can see other user's tagged PMs in DiscourseEPSS 0.4%CVE-2026-28282LOWDiscourse vulnerable to group membership addition permission bypass via discourse-policy pluginEPSS 0.4%CVE-2023-26040MEDIUMDiscourse chat messages susceptible to Cross-site Scripting through chat excerptsEPSS 0.4%CVE-2024-37157MEDIUMDiscourse vulnerable to Server-Side Request Forgery via FastImageEPSS 0.3%CVE-2026-27491MEDIUMDiscourse has a bypass of official warnings messages by non-staff usersEPSS 0.3%CVE-2024-39320MEDIUMDiscourse allows iframe injection though default site settingEPSS 0.3%CVE-2026-27740MEDIUMDiscourse has Stored XSS in AI Triage AutomationEPSS 0.3%CVE-2026-72732MEDIUMDiscourse: Templates endpoint exposes hidden tag namesEPSS 0.3%CVE-2025-46824LOWDiscourse Code Review Plugin vulnerable to XSS via auto link commitsEPSS 0.3%CVE-2024-35234MEDIUMDiscourse vulnerable to stored-dom XSS via Facebook OneboxesEPSS 0.3%CVE-2025-68662HIGHFinalDestination hostname matching allows SSRF protection bypassEPSS 0.3%CVE-2024-45297MEDIUMPrevent topic list filtering by hidden tags for unauthorized users in DiscourseEPSS 0.3%CVE-2024-47772MEDIUMCross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in DiscourseEPSS 0.3%CVE-2026-27936MEDIUMDiscourse discloses restricted post-action counts to non-privileged usersEPSS 0.3%CVE-2026-45775MEDIUMDiscourse: Cross-site backup access via path traversal in multisite local backupsEPSS 0.3%CVE-2026-32099MEDIUMDiscourse prevents hidden profile data leak via user oneboxEPSS 0.3%