Vulnerabilidades em discourse

323 resultados
Análise Vexday

Com 278 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em comparação ao universo típico de produtos monitorados. Ainda assim, 31 vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descobertas recentes que exige acompanhamento contínuo. A falha mais prevalente é CWE-200 (exposição de informações sensíveis), padrão que tende a se manifestar em plataformas de comunicação e pode facilitar reconhecimento por parte de atacantes. A CVE mais perigosa ativa atualmente é CVE-2024-53991, com escore EPSS de 0,2543 — o mais alto observado no conjunto —, e entre as cinco vulnerabilidades críticas catalogadas quatro já contam com prova de conceito pública, o que eleva o risco de exploração para equipes que ainda não aplicaram as correções correspondentes.

CVE-2023-28111MEDIUMDiscourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addressesEPSS 0.6%CVE-2021-32764HIGHYouTube Onebox susceptible to XSSEPSS 0.5%CVE-2026-59828MEDIUMDiscourse: Hidden post revisions leak through adjacent visible diffsEPSS 0.5%CVE-2023-37906MEDIUMDiscourse vulnerable to DoS via post edit reasonEPSS 0.5%CVE-2023-23622MEDIUMDiscourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all usersEPSS 0.5%CVE-2022-31096MEDIUMInvites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in DiscourseEPSS 0.5%CVE-2023-44384MEDIUMDiscourse-Jira could make SSRF attack by setting Jira URL to an arbitrary locationEPSS 0.5%CVE-2023-25172MEDIUMDiscourse vulnerable to Cross-site Scripting - user name displayed on postEPSS 0.5%CVE-2026-72723MEDIUMDiscourse: Anonymous sidebar serialization exposes descriptions of category-restricted tagsEPSS 0.5%CVE-2023-22455MEDIUMDiscourse vulnerable to Cross-site Scripting through tag descriptionsEPSS 0.5%CVE-2023-22468HIGHDiscourse vulnerable to Cross-site Scripting in local oneboxesEPSS 0.5%CVE-2025-53102HIGHDiscourse's WebAuthn challenge isn't cleared from user session after authenticationEPSS 0.5%CVE-2023-48297HIGHDiscourse vulnerable to unlimited mentioned users in message serializerEPSS 0.5%CVE-2026-46413MEDIUMDiscourse: Regular users can route multipart uploads into the admin backup storeEPSS 0.5%CVE-2022-46180MEDIUMArbitrary HTML injection in discourse-mermaid-theme-componentEPSS 0.5%CVE-2026-49256MEDIUMDiscourse: Hidden tag names leaked via category serializersEPSS 0.5%CVE-2022-41944LOWDiscourse users can see notifications for topics they no longer have access toEPSS 0.5%CVE-2023-23935LOWPresence of restricted personal Discourse messages may be leaked if tagged with a tag EPSS 0.5%CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%CVE-2026-45780MEDIUMDiscourse: Private event sample invitees are serialized to non-invited event viewersEPSS 0.5%