Vulnerabilidades em discourse

323 resultados
Análise Vexday

Com 278 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em comparação ao universo típico de produtos monitorados. Ainda assim, 31 vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descobertas recentes que exige acompanhamento contínuo. A falha mais prevalente é CWE-200 (exposição de informações sensíveis), padrão que tende a se manifestar em plataformas de comunicação e pode facilitar reconhecimento por parte de atacantes. A CVE mais perigosa ativa atualmente é CVE-2024-53991, com escore EPSS de 0,2543 — o mais alto observado no conjunto —, e entre as cinco vulnerabilidades críticas catalogadas quatro já contam com prova de conceito pública, o que eleva o risco de exploração para equipes que ainda não aplicaram as correções correspondentes.

CVE-2023-23616LOWDiscourse membership requests lack character limitEPSS 0.7%CVE-2026-44787HIGHDiscourse: Signup-time primary_group_id assignment grants whisperer accessEPSS 0.7%CVE-2023-23620MEDIUMDiscourse restricted tag routes leak topic informationEPSS 0.7%CVE-2022-46159MEDIUMAny authenticated Discourse user can create an unlisted topicEPSS 0.7%CVE-2022-24850MEDIUMCategory group permissions leaked in DiscourseEPSS 0.7%CVE-2023-28107MEDIUMDiscourse vulnerable to multisite DoS by spamming backupsEPSS 0.7%CVE-2022-24866MEDIUMExposure of Sensitive Information to an Unauthorized Actor in Discourse AssignEPSS 0.7%CVE-2022-39241HIGHPossible Server-Side Request Forgery (SSRF) in webhooksEPSS 0.6%CVE-2023-44388HIGHMalicious requests can fill up the log files resulting in a deinal of service in DiscourseEPSS 0.6%CVE-2023-38684MEDIUMDiscourse vulnerable to ossible DDoS due to unbounded limits in various controller actionsEPSS 0.6%CVE-2026-45788MEDIUMDiscourse: Secure uploads exposed by hotlinked image copyingEPSS 0.6%CVE-2023-22453MEDIUMDiscourse vulnerable to exposure of user post counts per topic to unauthorized usersEPSS 0.6%CVE-2021-41263HIGHSecure/signed cookies share secrets between sites in rails_multisiteEPSS 0.6%CVE-2026-72724MEDIUMDiscourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID MismatchEPSS 0.6%CVE-2022-23549MEDIUMDiscourse vulnerable to bypass of post max_length using HTML commentsEPSS 0.6%CVE-2023-40588MEDIUMDiscourse DoS via 2FA and Security Key NamesEPSS 0.6%CVE-2023-41043MEDIUMDiscourse DoS via SvgSprite cacheEPSS 0.6%CVE-2023-22454HIGHDiscourse vulnerable to Cross-site Scripting through pending post titles descriptionsEPSS 0.6%CVE-2023-41042MEDIUMDiscourse DoS via remote theme assetsEPSS 0.6%CVE-2026-55420HIGHDiscourse: Remote code execution via pdf uploadsEPSS 0.6%