Vulnerabilidades em discourse

323 resultados
Análise Vexday

Com 278 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em comparação ao universo típico de produtos monitorados. Ainda assim, 31 vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descobertas recentes que exige acompanhamento contínuo. A falha mais prevalente é CWE-200 (exposição de informações sensíveis), padrão que tende a se manifestar em plataformas de comunicação e pode facilitar reconhecimento por parte de atacantes. A CVE mais perigosa ativa atualmente é CVE-2024-53991, com escore EPSS de 0,2543 — o mais alto observado no conjunto —, e entre as cinco vulnerabilidades críticas catalogadas quatro já contam com prova de conceito pública, o que eleva o risco de exploração para equipes que ainda não aplicaram as correções correspondentes.

CVE-2026-59830MEDIUMDiscourse: Stored XSS via unescaped actor name in post actionsEPSS 0.3%CVE-2024-52794MEDIUMMagnific lightbox susceptible to Cross-site Scripting in DiscourseEPSS 0.3%CVE-2024-53994MEDIUMPotential bypass of chat permissions in DiscourseEPSS 0.3%CVE-2025-64528MEDIUMUsers are able to find users by name even when `enable_names` is offEPSS 0.3%CVE-2026-91123HIGHDiscourse: Reject literal backslash path separators in iframe src traversal guardEPSS 0.3%CVE-2026-27935MEDIUMDiscourse leaks private topic metadata to non-authorized usersEPSS 0.3%CVE-2026-91133MEDIUMDiscourse: Escape LIKE metacharacters in upload paths to prevent disclosureEPSS 0.3%CVE-2025-68934MEDIUMDiscourse Has Denial of Service (DoS) Vulnerability in Drafts Creation EndpointEPSS 0.3%CVE-2024-53266MEDIUMCross-site Scripting (XSS) via topic titles when CSP disabled in DiscourseEPSS 0.3%CVE-2023-37904LOWDiscourse Race Condition in Accept InviteEPSS 0.3%CVE-2026-33422LOWDiscourse exposes ip_address of flagged userEPSS 0.3%CVE-2026-55704MEDIUMDiscourse: Shared-draft titles and excerpts leak through group post serializationEPSS 0.3%CVE-2026-33393MEDIUMDiscourse fixes loose hostname matching in spam host allowlistEPSS 0.3%CVE-2025-69218HIGHDiscourse moderators can access admin-only reports exposing private upload URLsEPSS 0.3%CVE-2017-20290MEDIUMDiscourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribedEPSS 0.3%CVE-2025-47288LOWDiscourse Policy plugin private group members visibleEPSS 0.3%CVE-2023-45816LOWUnread bookmark reminder notifications that the user cannot access can be seenEPSS 0.3%CVE-2026-21865MEDIUMDiscourse topic conversion permission vulnerability for moderatorsEPSS 0.3%CVE-2026-27162MEDIUMDIscourse doesn't prevent whispers to leak in excerptsEPSS 0.3%CVE-2025-32376MEDIUMDiscourse DM limits aren’t always properly enforcedEPSS 0.3%