Discourse vulnerabilities
323 CVEs and advisories name Discourse as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-29196HTML injection via topic embedding in Discourse
- CVE-2023-28440Denial of service via admin theme import route in Discourse
- CVE-2023-28112Discourse's SSRF protection missing for some FastImage requests
- CVE-2023-28111Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses
- CVE-2023-28107Discourse vulnerable to multisite DoS by spamming backups
- CVE-2023-25172Discourse vulnerable to Cross-site Scripting - user name displayed on post
- CVE-2023-26040Discourse chat messages susceptible to Cross-site Scripting through chat excerpts
- CVE-2023-23622Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users
- CVE-2023-23935Presence of restricted personal Discourse messages may be leaked if tagged with a tag
- CVE-2023-25169Yearly Review Plugin leaking anonymised users data in discourse-yearly-review
- CVE-2023-25819Discourse tags with no visibility are leaking into og:article:tag
- CVE-2023-25167Regular expression denial of service via installing themes via git in discourse
- CVE-2023-23615Malicious users in Discourse can create spam topics as any user due to improper access control
- CVE-2023-23624Discourse's exclude_tags param could leak which topics had a specific hidden tag
- CVE-2023-23621Discourse vulnerable to ReDoS in user agent parsing
- CVE-2023-22740Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts
- CVE-2023-23620Discourse restricted tag routes leak topic information
- CVE-2023-23616Discourse membership requests lack character limit
- CVE-2023-22739Discourse subject to Allocation of Resources Without Limits or Throttling
- CVE-2023-22468Discourse vulnerable to Cross-site Scripting in local oneboxes
- CVE-2023-22455Discourse vulnerable to Cross-site Scripting through tag descriptions
- CVE-2023-22454Discourse vulnerable to Cross-site Scripting through pending post titles descriptions
- CVE-2023-22453Discourse vulnerable to exposure of user post counts per topic to unauthorized users
- CVE-2022-46177Discourse password reset link can lead to in account takeover if user changes to a new email
- CVE-2022-23546Discourse vulnerable to private topic leak via email#send_digest
- CVE-2022-46168Group SMTP user emails are exposed in CC email header
- CVE-2022-23549Discourse vulnerable to bypass of post max_length using HTML comments
- CVE-2022-23548Discourse is an option source discussion platform.
- CVE-2022-46180Arbitrary HTML injection in discourse-mermaid-theme-component
- CVE-2022-46159Any authenticated Discourse user can create an unlisted topic