Skip to contentDiscourse vulnerabilities
Newest
- discourseSecure category names leaked via user activity export in DiscourseCVE-2022-24782Fix available4.3 Medium
- discourseDenial of Service in DiscourseCVE-2022-23641Fix available6.5 Medium
- discourseGroup advanced search option may leak group and group's members visibilityCVE-2022-216774.3 Medium
- discourseUser can bypass approval when invited to DiscourseCVE-2022-21684Fix available4.3 Medium
- discourseUser's bio visible even if profile is restricted in DiscourseCVE-2022-21678Fix available4.3 Medium
- discourseExposure of whisper participants in discourseCVE-2022-21642Fix available4.3 Medium
- discourseDenial of Service in discourseCVE-2021-43850Fix available6.8 Medium
- discourse message busPath traversal in message_busCVE-2021-43840Fix available4.4 Medium
- discourse discourse-footnote, footnote +1 moreInline footnotes wrapped in <a> tags can cause errors in discourse-footnotesCVE-2021-438274.3 Medium
- discourseBypass of Poll voting limits in DiscourseCVE-2021-43793Fix available4.3 Medium
- discourseAnonymous user cache poisoning via development-mode header in DiscourseCVE-2021-43794Fix available5.3 Medium
- discourseNotifications leak in DiscourseCVE-2021-43792Fix available4.3 Medium
- discourseCache poisoning via maliciously-formed request in discourseCVE-2021-412714.8 Medium
- discourse rails multisiteSecure/signed cookies share secrets between sites in rails_multisiteCVE-2021-41263Fix available8.3 High
- discourseRCE via malicious SNS subscription payloadCVE-2021-41163Fix availableEPSS 19.8%10.0 Critical
- discourse discourse-reactions, reactions +1 moreReactions leak for secure category topics and private messagesCVE-2021-411405.3 Medium
- discourseXSS via blocked watched word in error messageCVE-2021-410954.2 Medium
- discourseServer Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email...CVE-2020-24327Fix available5.3 Medium
- discoursePrivate message title and participating users leaked in discourseCVE-2021-410827.5 High
- discourseCross-site scripting via category name in DiscourseCVE-2021-39161Fix available4.4 Medium
- discourseInformation exposure in DiscourseCVE-2021-37703Fix available4.3 Medium
- discourseRe-use of email tokens in DiscourseCVE-2021-37693Fix available5.3 Medium
- discourseXSS via d-popover and d-html-popover attributeCVE-2021-37633Fix available7.4 High
- discoursePost creator of a whisper post can be revealed to non-staff users in DiscourseCVE-2021-32788Fix available4.3 Medium
- discourseYouTube Onebox susceptible to XSSCVE-2021-327648.1 High
- discourseIn Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement...CVE-2021-3138Public exploit7.5 High
- discourseDiscourse 2.3.2 sends the CSRF token in the query string.CVE-2019-155156.5 Medium
- discourseDiscourse before v2.4.0.beta2 lacks a confirmation screen when logging in via an email link.CVE-2019-10200187.3 High
- discourseDiscourse before v2.4.0.beta2 lacks a confirmation screen when logging in via a user-api OTP.CVE-2019-10200175.3 Medium