Skip to contentDiscourse vulnerabilities
Newest
- discourseDiscourse improperly sanitized user input leads to XSSCVE-2024-23834Fix available6.3 Medium
- discourseDiscourse secure uploads accessible to guests even when login is requiredCVE-2023-49099Fix available3.1 Low
- discourseInsufficient control of custom field value sizesCVE-2024-21655Fix available4.3 Medium
- discourse discourse-reactions, reactions +1 moreReaction data for user notifications exposed in Discourse-reactionsCVE-2023-490983.5 Low
- discourseDiscourse vulnerable to unlimited mentioned users in message serializerCVE-2023-48297Fix available8.6 High
- discourseDiscourse SSRF vulnerability in EmbeddingCVE-2023-47121Fix available3.4 Low
- discourseDiscourse DoS through Onebox favicon URLCVE-2023-47120Fix available7.5 High
- discourseHTML injection in oneboxed linksCVE-2023-47119Public exploitFix available5.3 Medium
- discourseBypassing height value allowed in some theme componentsCVE-2023-46130Fix available4.3 Medium
- discourseUnread bookmark reminder notifications that the user cannot access can be seenCVE-2023-45816Fix available3.3 Low
- discourseDiscourse vulnerable to DoS via Regexp Injection in Full NameCVE-2023-45806Public exploitFix available4.3 Medium
- discourse discourse-calendar, calendar +1 moreImproper escaping of user input in discourse-calendarCVE-2023-436588.0 High
- discourseUnauthenticated access to new private chat messages in DiscourseCVE-2023-45131Public exploit7.5 High
- discoursePrevent unauthorized access to summary details in DiscourseCVE-2023-443915.3 Medium
- discourseMalicious requests can fill up the log files resulting in a deinal of service in DiscourseCVE-2023-443887.5 High
- discourseExposure of poll options and votes to unauthorized users in DiscourseCVE-2023-438143.7 Low
- discourseCross-site Scripting via email preview when CSP disabled in DiscourseCVE-2023-436598.0 High
- discourseArbitrary keys can be added to a topic's custom fields by any user in DiscourseCVE-2023-451474.9 Medium
- discourse discourse-jira, jira +1 moreDiscourse-Jira could make SSRF attack by setting Jira URL to an arbitrary locationCVE-2023-443844.1 Medium
- discourse discourse-encryptImproper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configurationCVE-2023-436577.2 High
- discourseDiscourse DoS via SvgSprite cacheCVE-2023-41043Fix available6.5 Medium
- discourseDiscourse DoS via remote theme assetsCVE-2023-41042Fix available4.9 Medium
- discourseDiscourse DoS via 2FA and Security Key NamesCVE-2023-40588Fix available6.5 Medium
- discourseDiscourse vulnerable to DoS via draftsCVE-2023-38706Fix available6.5 Medium
- discourseDiscourse's restricted tag information visible to unauthenticated usersCVE-2023-38685Fix available4.3 Medium
- discourseDiscourse vulnerable to ossible DDoS due to unbounded limits in various controller actionsCVE-2023-38684Fix available5.3 Medium
- discourseDiscourse vulnerable to DoS via defer queueCVE-2023-38498Fix available4.3 Medium
- discourseDiscourse vulnerable to DoS via post edit reasonCVE-2023-37906Fix available4.3 Medium
- discourseDiscourse Race Condition in Accept InviteCVE-2023-37904Fix available2.6 Low
- discourseDiscourse CSP nonce reuse vulnerability for anonymous usersCVE-2023-374676.8 Medium
- discourseDenial of service via User Custom Sidebar Section Unlimited Link Creation in discourseCVE-2023-368186.5 Medium
- discourseTopic Title Validation Skipped When Changing Category in DiscourseCVE-2023-36466Fix available3.5 Low
- discourseCSP nonce reuse vulnerability in DiscourseCVE-2023-36473Fix available6.8 Medium
- discourseDiscourse vulnerable to exposure of number of topics recently created in private categoriesCVE-2023-34250Fix available4.8 Medium
- discourseDiscourse's canonical url not being used for topic embeddingsCVE-2023-32301Fix available3.1 Low
- discourseDiscourse Topic Creation Page Allows iFrame Tag without RestrictionsCVE-2023-32061Fix available5.4 Medium
- discourseDiscourse's general category permissions could be set back to defaultCVE-2023-31142Fix available2.0 Low
- discourse discourse-reactions, reactions +1 moreReaction metadata exposed in private topics in Discourse-reactionsCVE-2023-306114.3 Medium
- discourseMultisite denial of service through unsanitized dynamic dispatch to SiteSetting in DiscourseCVE-2023-30606Fix available4.2 Medium
- discourseStored Cross-site Scripting via improper sanitization of svg files in DiscourseCVE-2023-30538Fix available5.4 Medium
- discourseHTML injection via topic embedding in DiscourseCVE-2023-29196Fix available4.2 Medium
- discourseDenial of service via admin theme import route in DiscourseCVE-2023-28440Fix available2.7 Low
- discourseDiscourse's SSRF protection missing for some FastImage requestsCVE-2023-28112Fix available5.9 Medium
- discourseDiscourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addressesCVE-2023-28111Fix available5.7 Medium
- discourseDiscourse vulnerable to multisite DoS by spamming backupsCVE-2023-28107Fix available4.5 Medium
- discourseDiscourse vulnerable to Cross-site Scripting - user name displayed on postCVE-2023-25172Fix available4.4 Medium
- discourseDiscourse chat messages susceptible to Cross-site Scripting through chat excerptsCVE-2023-260406.5 Medium
- discourseDiscourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all usersCVE-2023-23622Fix available4.3 Medium
- discoursePresence of restricted personal Discourse messages may be leaked if tagged with a tagCVE-2023-23935Fix available3.5 Low
- discourse discourse-yearly-review, yearly review +1 moreYearly Review Plugin leaking anonymised users data in discourse-yearly-reviewCVE-2023-251693.1 Low
- Show moreLoading…