Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-23641Denial of Service in Discourse
- CVE-2022-21677Group advanced search option may leak group and group's members visibility
- CVE-2022-21684User can bypass approval when invited to Discourse
- CVE-2022-21678User's bio visible even if profile is restricted in Discourse
- CVE-2022-21642Exposure of whisper participants in discourse
- CVE-2021-43850Denial of Service in discourse
- CVE-2021-43840Path traversal in message_bus
- CVE-2021-43827Inline footnotes wrapped in <a> tags can cause errors in discourse-footnotes
- CVE-2021-43793Bypass of Poll voting limits in Discourse
- CVE-2021-43794Anonymous user cache poisoning via development-mode header in Discourse
- CVE-2021-43792Notifications leak in Discourse
- CVE-2021-41271Cache poisoning via maliciously-formed request in discourse
- CVE-2021-41263Secure/signed cookies share secrets between sites in rails_multisite
- CVE-2021-41163RCE via malicious SNS subscription payload
- CVE-2021-41140Reactions leak for secure category topics and private messages
- CVE-2021-41095XSS via blocked watched word in error message
- CVE-2021-41082Private message title and participating users leaked in discourse
- CVE-2021-39161Cross-site scripting via category name in Discourse
- CVE-2021-37703Information exposure in Discourse
- CVE-2021-37693Re-use of email tokens in Discourse
- CVE-2021-37633XSS via d-popover and d-html-popover attribute
- CVE-2021-32788Post creator of a whisper post can be revealed to non-staff users in Discourse
- CVE-2021-32764YouTube Onebox susceptible to XSS