Vulnerabilidades em discourse

323 resultados
Análise Vexday

Com 278 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em comparação ao universo típico de produtos monitorados. Ainda assim, 31 vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descobertas recentes que exige acompanhamento contínuo. A falha mais prevalente é CWE-200 (exposição de informações sensíveis), padrão que tende a se manifestar em plataformas de comunicação e pode facilitar reconhecimento por parte de atacantes. A CVE mais perigosa ativa atualmente é CVE-2024-53991, com escore EPSS de 0,2543 — o mais alto observado no conjunto —, e entre as cinco vulnerabilidades críticas catalogadas quatro já contam com prova de conceito pública, o que eleva o risco de exploração para equipes que ainda não aplicaram as correções correspondentes.

CVE-2023-25819MEDIUMDiscourse tags with no visibility are leaking into og:article:tagEPSS 0.5%CVE-2022-39270MEDIUMArbitrary HTML injection in table-of-contents theme component in DiscoTOCEPSS 0.5%CVE-2022-39279MEDIUMDiscourse-chat plugin susceptible to XSS in channel name and descriptionEPSS 0.5%CVE-2024-28242MEDIUMDisclosure of the existence of secret categories with custom backgrounds in DiscourseEPSS 0.5%CVE-2022-46148HIGHDiscourse allows self-XSS through malicious composer messageEPSS 0.5%CVE-2023-44391MEDIUMPrevent unauthorized access to summary details in DiscourseEPSS 0.5%CVE-2024-23834MEDIUMDiscourse improperly sanitized user input leads to XSSEPSS 0.5%CVE-2026-72729LOWDiscourse: Stored XSS in discourse-local-dates pluginEPSS 0.5%CVE-2026-91157HIGHDiscourse: Media uploads remain publicly accessible after category permissions are restrictedEPSS 0.5%CVE-2023-43659HIGHCross-site Scripting via email preview when CSP disabled in DiscourseEPSS 0.5%CVE-2026-91156HIGHDiscourse: Chat MessageBus delivers read-restricted messages to unauthorized usersEPSS 0.5%CVE-2023-38685MEDIUMDiscourse's restricted tag information visible to unauthenticated usersEPSS 0.5%CVE-2024-38360MEDIUMDenial of service via Watched Words in DiscourseEPSS 0.5%CVE-2024-43789HIGHDenial of service by the absence of restrictions on replies to posts in DiscourseEPSS 0.5%CVE-2024-24748MEDIUMDisclosure of the existence of secret subcategories in DiscourseEPSS 0.5%CVE-2024-53851MEDIUMPartial denial of service via inline oneboxes in DiscourseEPSS 0.5%CVE-2026-72726MEDIUMDiscourse: Unauthorized eavesdropping on private AI bot conversations.EPSS 0.5%CVE-2023-23615MEDIUMMalicious users in Discourse can create spam topics as any user due to improper access controlEPSS 0.5%CVE-2026-72722MEDIUMDiscourse: Duplicate lookup reveals restricted topic titles through canonicalized URLsEPSS 0.4%CVE-2026-33355MEDIUMDiscourse filters whisper posts from private-posts feedEPSS 0.4%