Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-46162Discourse BBCode plugin vulnerable to arbitrary CSS injection
- CVE-2022-46150Discourse may allow exposure of hidden tags in the subject of notification emails
- CVE-2022-46148Discourse allows self-XSS through malicious composer message
- CVE-2022-41944Discourse users can see notifications for topics they no longer have access to
- CVE-2022-41921Discourse chat messages should have a maximum character limit
- CVE-2022-41913Discourse-calendar exposes members of hidden groups
- CVE-2022-39385Users erroneously and transparently added to private messages in Discourse
- CVE-2022-39378Displaying user badges can leak topic titles to users that have no access to the topic
- CVE-2022-39356Discourse user account takeover via email and invite link
- CVE-2022-39241Possible Server-Side Request Forgery (SSRF) in webhooks
- CVE-2022-39355Discourse Patreon vulnerable to improper validation of email during Patreon authentication
- CVE-2022-39279Discourse-chat plugin susceptible to XSS in channel name and description
- CVE-2022-39270Arbitrary HTML injection in table-of-contents theme component in DiscoTOC
- CVE-2022-39232Discourse vulnerable to incomplete quote causing a topic to crash in the browser
- CVE-2022-39226Discourse user profile location and website fields were not sufficiently length-limited
- CVE-2022-36068Discourse moderators can edit themes via the API
- CVE-2022-36066Discourse vulnerable to RCE via admins uploading maliciously zipped file
- CVE-2022-36057Discourse-Chat Cross-Site Scripting issue for channel names and descriptions
- CVE-2022-31184Email activation route can be abused by spammers in Discourse
- CVE-2022-31182Cache poisoning via maliciously-formed request in Discourse
- CVE-2022-31096Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse
- CVE-2022-31095Exposure of Sensitive Information in discourse-chat
- CVE-2022-31060Banner topic data is exposed on login-required Discourse sites
- CVE-2022-31059Discourse Calendar Event names susceptible to Cross-site Scripting
- CVE-2022-31025Invite bypasses user approval in Discourse
- CVE-2022-24866Exposure of Sensitive Information to an Unauthorized Actor in Discourse Assign
- CVE-2022-24850Category group permissions leaked in Discourse
- CVE-2022-24824Anonymous user cache poisoning in discourse
- CVE-2022-24804Private group name exposure in discourse
- CVE-2022-24782Secure category names leaked via user activity export in Discourse