Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-45806Discourse vulnerable to DoS via Regexp Injection in Full Name
- CVE-2023-43658Improper escaping of user input in discourse-calendar
- CVE-2023-45131Unauthenticated access to new private chat messages in Discourse
- CVE-2023-44391Prevent unauthorized access to summary details in Discourse
- CVE-2023-44388Malicious requests can fill up the log files resulting in a deinal of service in Discourse
- CVE-2023-43814Exposure of poll options and votes to unauthorized users in Discourse
- CVE-2023-43659Cross-site Scripting via email preview when CSP disabled in Discourse
- CVE-2023-45147Arbitrary keys can be added to a topic's custom fields by any user in Discourse
- CVE-2023-44384Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location
- CVE-2023-43657Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration
- CVE-2023-41043Discourse DoS via SvgSprite cache
- CVE-2023-41042Discourse DoS via remote theme assets
- CVE-2023-40588Discourse DoS via 2FA and Security Key Names
- CVE-2023-38706Discourse vulnerable to DoS via drafts
- CVE-2023-38685Discourse's restricted tag information visible to unauthenticated users
- CVE-2023-38684Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actions
- CVE-2023-38498Discourse vulnerable to DoS via defer queue
- CVE-2023-37906Discourse vulnerable to DoS via post edit reason
- CVE-2023-37904Discourse Race Condition in Accept Invite
- CVE-2023-37467Discourse CSP nonce reuse vulnerability for anonymous users
- CVE-2023-36818Denial of service via User Custom Sidebar Section Unlimited Link Creation in discourse
- CVE-2023-36466Topic Title Validation Skipped When Changing Category in Discourse
- CVE-2023-36473CSP nonce reuse vulnerability in Discourse
- CVE-2023-34250Discourse vulnerable to exposure of number of topics recently created in private categories
- CVE-2023-32301Discourse's canonical url not being used for topic embeddings
- CVE-2023-32061Discourse Topic Creation Page Allows iFrame Tag without Restrictions
- CVE-2023-31142Discourse's general category permissions could be set back to default
- CVE-2023-30611Reaction metadata exposed in private topics in Discourse-reactions
- CVE-2023-30606Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse
- CVE-2023-30538Stored Cross-site Scripting via improper sanitization of svg files in Discourse