Skip to contentDiscourse vulnerabilities
Newest
- discourseDiscourse tags with no visibility are leaking into og:article:tagCVE-2023-25819Fix available5.3 Medium
- discourseRegular expression denial of service via installing themes via git in discourseCVE-2023-25167Fix available6.5 Medium
- discourseMalicious users in Discourse can create spam topics as any user due to improper access controlCVE-2023-23615Fix available5.3 Medium
- discourseDiscourse's exclude_tags param could leak which topics had a specific hidden tagCVE-2023-23624Fix available4.3 Medium
- discourseDiscourse vulnerable to ReDoS in user agent parsingCVE-2023-23621Fix available8.6 High
- discourseDiscourse vulnerable to Allocation of Resources Without Limits via Chat draftsCVE-2023-22740Fix available4.3 Medium
- discourseDiscourse restricted tag routes leak topic informationCVE-2023-23620Fix available5.3 Medium
- discourseDiscourse membership requests lack character limitCVE-2023-23616Fix available3.5 Low
- discourseDiscourse subject to Allocation of Resources Without Limits or ThrottlingCVE-2023-22739Fix available6.5 Medium
- discourseDiscourse vulnerable to Cross-site Scripting in local oneboxesCVE-2023-22468Fix available8.8 High
- discourseDiscourse vulnerable to Cross-site Scripting through tag descriptionsCVE-2023-22455Fix available6.8 Medium
- discourseDiscourse vulnerable to Cross-site Scripting through pending post titles descriptionsCVE-2023-22454Fix available8.0 High
- discourseDiscourse vulnerable to exposure of user post counts per topic to unauthorized usersCVE-2023-22453Fix available5.3 Medium
- discourseDiscourse password reset link can lead to in account takeover if user changes to a new emailCVE-2022-46177Fix available5.7 Medium
- discourseDiscourse vulnerable to private topic leak via email#send_digestCVE-2022-23546Fix available5.5 Medium
- discourseGroup SMTP user emails are exposed in CC email headerCVE-2022-46168Fix available3.5 Low
- discourseDiscourse vulnerable to bypass of post max_length using HTML commentsCVE-2022-23549Fix available5.7 Medium
- discourseDiscourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta16 on the beta and tests-passed branches, parsing posts can be susceptible to regu…CVE-2022-23548Fix available6.5 Medium
- discourse discourse-mermaid-theme-component, mermaid +1 moreArbitrary HTML injection in discourse-mermaid-theme-componentCVE-2022-461805.0 Medium
- discourseAny authenticated Discourse user can create an unlisted topicCVE-2022-46159Fix available4.3 Medium
- discourse discourse-bbcode, bbcode +1 moreDiscourse BBCode plugin vulnerable to arbitrary CSS injectionCVE-2022-461628.8 High
- discourseDiscourse may allow exposure of hidden tags in the subject of notification emailsCVE-2022-46150Fix available4.3 Medium
- discourseDiscourse allows self-XSS through malicious composer messageCVE-2022-46148Fix available7.1 High
- discourseDiscourse users can see notifications for topics they no longer have access toCVE-2022-41944Fix available3.5 Low
- discourseDiscourse chat messages should have a maximum character limitCVE-2022-41921Fix available3.5 Low
- discourse calendar, discourse-calendar +1 moreDiscourse-calendar exposes members of hidden groupsCVE-2022-419134.3 Medium
- discourseUsers erroneously and transparently added to private messages in DiscourseCVE-2022-39385Fix available6.5 Medium
- discourseDisplaying user badges can leak topic titles to users that have no access to the topicCVE-2022-39378Fix available5.3 Medium
- discourseDiscourse user account takeover via email and invite linkCVE-2022-39356Fix available8.9 High
- discoursePossible Server-Side Request Forgery (SSRF) in webhooksCVE-2022-39241Fix available7.6 High
- discourse discourse-patreon, patreon +1 moreDiscourse Patreon vulnerable to improper validation of email during Patreon authenticationCVE-2022-393559.1 Critical
- discourse discourse-chatDiscourse-chat plugin susceptible to XSS in channel name and descriptionCVE-2022-392794.3 Medium
- discourse discotocArbitrary HTML injection in table-of-contents theme component in DiscoTOCCVE-2022-392705.4 Medium
- discourseDiscourse vulnerable to incomplete quote causing a topic to crash in the browserCVE-2022-392326.5 Medium
- discourseDiscourse user profile location and website fields were not sufficiently length-limitedCVE-2022-39226Fix available4.3 Medium
- discourseDiscourse moderators can edit themes via the APICVE-2022-36068Fix available7.2 High
- discourseDiscourse vulnerable to RCE via admins uploading maliciously zipped fileCVE-2022-36066Fix available9.1 Critical
- discourse discourse-chatDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsCVE-2022-360575.4 Medium
- discourseDiscourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an...CVE-2022-37458Fix available7.2 High
- discourseEmail activation route can be abused by spammers in DiscourseCVE-2022-311846.5 Medium
- discourseCache poisoning via maliciously-formed request in DiscourseCVE-2022-31182Fix available5.3 Medium
- discourseInvites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in DiscourseCVE-2022-310965.7 Medium
- discourse discourse-chatExposure of Sensitive Information in discourse-chatCVE-2022-310954.3 Medium
- discourseBanner topic data is exposed on login-required Discourse sitesCVE-2022-31060Fix available5.3 Medium
- discourse calendar, discourse-calendar +1 moreDiscourse Calendar Event names susceptible to Cross-site ScriptingCVE-2022-310596.5 Medium
- discourseInvite bypasses user approval in DiscourseCVE-2022-31025Fix available2.6 Low
- discourse assign, discourse-assign +1 moreExposure of Sensitive Information to an Unauthorized Actor in Discourse AssignCVE-2022-248664.3 Medium
- discourseCategory group permissions leaked in DiscourseCVE-2022-24850Fix available5.3 Medium
- discourseAnonymous user cache poisoning in discourseCVE-2022-24824Fix available5.3 Medium
- discoursePrivate group name exposure in discourseCVE-2022-24804Fix available5.3 Medium
- Show moreLoading…