Vulnerabilidades em discourse

323 resultados
Análise Vexday

Com 278 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em comparação ao universo típico de produtos monitorados. Ainda assim, 31 vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descobertas recentes que exige acompanhamento contínuo. A falha mais prevalente é CWE-200 (exposição de informações sensíveis), padrão que tende a se manifestar em plataformas de comunicação e pode facilitar reconhecimento por parte de atacantes. A CVE mais perigosa ativa atualmente é CVE-2024-53991, com escore EPSS de 0,2543 — o mais alto observado no conjunto —, e entre as cinco vulnerabilidades críticas catalogadas quatro já contam com prova de conceito pública, o que eleva o risco de exploração para equipes que ainda não aplicaram as correções correspondentes.

CVE-2024-31219MEDIUMDiscourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity pageEPSS 0.4%CVE-2023-36473MEDIUMCSP nonce reuse vulnerability in DiscourseEPSS 0.4%CVE-2026-72727MEDIUMDiscourse: Stored XSS in the moderation review queueEPSS 0.4%CVE-2024-26145MEDIUMUninvited user is able to join and mark the attendance of the the private eventEPSS 0.4%CVE-2023-30606MEDIUMMultisite denial of service through unsanitized dynamic dispatch to SiteSetting in DiscourseEPSS 0.4%CVE-2025-48053HIGHDiscourse vulnerable to DoS via large URL payload in PM to a botEPSS 0.4%CVE-2024-24755MEDIUMdiscourse-group-membership-ip-block is exposing potentially sensitive custom fieldsEPSS 0.4%CVE-2025-24972MEDIUMDiscourse may bypass user preference when adding users to chat groupsEPSS 0.4%CVE-2026-59829MEDIUMDiscourse: Review queue exposes flag-related private message excerpts to category group moderatorsEPSS 0.4%CVE-2023-43814LOWExposure of poll options and votes to unauthorized users in DiscourseEPSS 0.4%CVE-2024-35168MEDIUMWordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-45051HIGHBypass of email address validation via encoded email addresses in DiscourseEPSS 0.4%CVE-2025-22601LOWClient Side Path Traversal using activate account route in DiscourseEPSS 0.4%CVE-2026-33394LOWDiscourse leaks PM post edits to moderatorsEPSS 0.4%CVE-2026-27570MEDIUMDiscourse Vulnerable to Stored XSS via Shared AI Conversation OneboxEPSS 0.4%CVE-2024-36122LOWDiscourse doesn't limit reviewable user serializer payloadEPSS 0.4%CVE-2023-37467MEDIUMDiscourse CSP nonce reuse vulnerability for anonymous usersEPSS 0.4%CVE-2023-30538MEDIUMStored Cross-site Scripting via improper sanitization of svg files in DiscourseEPSS 0.4%CVE-2024-37165MEDIUMDiscourse has an XSS via Onebox systemEPSS 0.4%CVE-2024-49765MEDIUMBypass of Discourse Connect using other login paths if enabled in DiscourseEPSS 0.4%