Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-37299Discourse vulnerable to DoS via Tag Group
- CVE-2024-37165Discourse has an XSS via Onebox system
- CVE-2024-38360Denial of service via Watched Words in Discourse
- CVE-2024-37157Discourse vulnerable to Server-Side Request Forgery via FastImage
- CVE-2024-36122Discourse doesn't limit reviewable user serializer payload
- CVE-2024-36113Discourse missing authorization checks for suspending admins/moderators
- CVE-2024-35234Discourse vulnerable to stored-dom XSS via Facebook Oneboxes
- CVE-2024-35227Discourse vulnerable to DoS through Onebox
- CVE-2024-35168WordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerability
- CVE-2024-31219Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page
- CVE-2024-27085Denial of service through invites in Discourse
- CVE-2024-27100Denial of service via Staff Actions in Discourse
- CVE-2024-28242Disclosure of the existence of secret categories with custom backgrounds in Discourse
- CVE-2024-24748Disclosure of the existence of secret subcategories in Discourse
- CVE-2024-24827No rate limits on POST /uploads endpoint in Discourse
- CVE-2024-24817User can see invitees in events created in PMs and private categories
- CVE-2024-23654discourse-ai admin-initiated SSRF when interacting with AI services
- CVE-2024-26145Uninvited user is able to join and mark the attendance of the the private event
- CVE-2023-46241Potential account take over due to unverified emails from Microsoft Identity Platform
- CVE-2024-24755discourse-group-membership-ip-block is exposing potentially sensitive custom fields
- CVE-2024-23834Discourse improperly sanitized user input leads to XSS
- CVE-2023-49099Discourse secure uploads accessible to guests even when login is required
- CVE-2024-21655Insufficient control of custom field value sizes
- CVE-2023-49098Reaction data for user notifications exposed in Discourse-reactions
- CVE-2023-48297Discourse vulnerable to unlimited mentioned users in message serializer
- CVE-2023-47121Discourse SSRF vulnerability in Embedding
- CVE-2023-47120Discourse DoS through Onebox favicon URL
- CVE-2023-47119HTML injection in oneboxed links
- CVE-2023-46130Bypassing height value allowed in some theme components
- CVE-2023-45816Unread bookmark reminder notifications that the user cannot access can be seen