Advisories · Technology
discourse.
Every CVE that names discourse among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Denial of service through invites in Discourse
- discourse
- Denial of service
- CVSS 6.5 Medium
Denial of service via Staff Actions in Discourse
- discourse
- Denial of service
- CVSS 5.3 Medium
Disclosure of the existence of secret categories with custom backgrounds in Discourse
- discourse
- Information disclosure
- CVSS 5.3 Medium
Disclosure of the existence of secret subcategories in Discourse
- discourse
- Information disclosure
- CVSS 5.3 Medium
No rate limits on POST /uploads endpoint in Discourse
- discourse
- Denial of service
- CVSS 6.3 Medium
Discourse improperly sanitized user input leads to XSS
- discourse
- Cross-site scripting (XSS)
- CVSS 3.1 Low
Discourse secure uploads accessible to guests even when login is required
- discourse
- Broken access control
- CVSS 4.3 Medium
Insufficient control of custom field value sizes
- discourse
- Denial of service
- CVSS 8.6 High
Discourse vulnerable to unlimited mentioned users in message serializer
- discourse
- Denial of service
- CVSS 3.4 Low
Discourse SSRF vulnerability in Embedding
- discourse
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Discourse DoS through Onebox favicon URL
- discourse
- Denial of service
- CVSS 5.3 Medium
HTML injection in oneboxed links
- discourse
- Other injection
- CVSS 4.3 Medium
Bypassing height value allowed in some theme components
- discourse
- Denial of service
- CVSS 3.3 Low
Unread bookmark reminder notifications that the user cannot access can be seen
- discourse
- Information disclosure
- CVSS 4.3 Medium
Discourse vulnerable to DoS via Regexp Injection in Full Name
- discourse
- Denial of service
- CVSS 7.5 High
Unauthenticated access to new private chat messages in Discourse
- discourse
- Information disclosure
- CVSS 5.3 Medium
Prevent unauthorized access to summary details in Discourse
- discourse
- Information disclosure
- CVSS 7.5 High
Malicious requests can fill up the log files resulting in a deinal of service in Discourse
- discourse
- Denial of service
- CVSS 3.7 Low
Exposure of poll options and votes to unauthorized users in Discourse
- discourse
- Information disclosure
- Broken access control
- CVSS 8.0 High
Cross-site Scripting via email preview when CSP disabled in Discourse
- discourse
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Arbitrary keys can be added to a topic's custom fields by any user in Discourse
- discourse
- Information disclosure
- CVSS 6.5 Medium
Discourse DoS via SvgSprite cache
- discourse
- Denial of service
- CVSS 4.9 Medium
Discourse DoS via remote theme assets
- discourse
- Denial of service
- CVSS 6.5 Medium
Discourse DoS via 2FA and Security Key Names
- discourse
- Denial of service
- CVSS 6.5 Medium
Discourse vulnerable to DoS via drafts
- discourse
- Denial of service
- CVSS 4.3 Medium
Discourse's restricted tag information visible to unauthenticated users
- discourse
- Information disclosure
- CVSS 5.3 Medium
Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actions
- discourse
- Denial of service
- CVSS 4.3 Medium
Discourse vulnerable to DoS via defer queue
- discourse
- Denial of service
- CVSS 4.3 Medium
Discourse vulnerable to DoS via post edit reason
- discourse
- Denial of service
- CVSS 2.6 Low
Discourse Race Condition in Accept Invite
- discourse
- Race condition
- CVSS 6.8 Medium
Discourse CSP nonce reuse vulnerability for anonymous users
- discourse
- CWE-323
- CVSS 6.5 Medium
Denial of service via User Custom Sidebar Section Unlimited Link Creation in discourse
- discourse
- Denial of service
- CVSS 3.5 Low
Topic Title Validation Skipped When Changing Category in Discourse
- discourse
- CWE-20
- CVSS 6.8 Medium
CSP nonce reuse vulnerability in Discourse
- discourse
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Discourse vulnerable to exposure of number of topics recently created in private categories
- discourse
- Information disclosure
- CVSS 3.1 Low
Discourse's canonical url not being used for topic embeddings
- discourse
- CWE-116
- CVSS 5.4 Medium
Discourse Topic Creation Page Allows iFrame Tag without Restrictions
- discourse
- Broken access control
- CVSS 2.0 Low
Discourse's general category permissions could be set back to default
- discourse
- Broken access control
- CVSS 4.2 Medium
Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse
- discourse
- Broken access control
- CVSS 5.4 Medium
Stored Cross-site Scripting via improper sanitization of svg files in Discourse
- discourse
- Cross-site scripting (XSS)
- CVSS 4.2 Medium
HTML injection via topic embedding in Discourse
- discourse
- Cross-site scripting (XSS)
- CVSS 2.7 Low
Denial of service via admin theme import route in Discourse
- discourse
- Denial of service
- CVSS 5.9 Medium
Discourse's SSRF protection missing for some FastImage requests
- discourse
- Server-side request forgery (SSRF)
- CVSS 5.7 Medium
Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses
- discourse
- Server-side request forgery (SSRF)
- CVSS 4.5 Medium
Discourse vulnerable to multisite DoS by spamming backups
- discourse
- Denial of service
- CVSS 4.4 Medium
Discourse vulnerable to Cross-site Scripting - user name displayed on post
- discourse
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Discourse chat messages susceptible to Cross-site Scripting through chat excerpts
- discourse
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users
- discourse
- Information disclosure
- CVSS 3.5 Low
Presence of restricted personal Discourse messages may be leaked if tagged with a tag
- discourse
- Information disclosure
- CVSS 5.3 Medium
Discourse tags with no visibility are leaking into og:article:tag
- discourse
- Information disclosure
- CVSS 6.5 Medium
Regular expression denial of service via installing themes via git in discourse
- discourse
- Denial of service
- CVSS 5.3 Medium
Malicious users in Discourse can create spam topics as any user due to improper access control
- discourse
- Broken access control
- CVSS 4.3 Medium
Discourse's exclude_tags param could leak which topics had a specific hidden tag
- discourse
- Information disclosure
- CVSS 8.6 High
Discourse vulnerable to ReDoS in user agent parsing
- discourse
- Denial of service
- CVSS 4.3 Medium
Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts
- discourse
- Denial of service
- CVSS 5.3 Medium
Discourse restricted tag routes leak topic information
- discourse
- Information disclosure
- CVSS 3.5 Low
Discourse membership requests lack character limit
- discourse
- Denial of service
- CVSS 6.5 Medium
Discourse subject to Allocation of Resources Without Limits or Throttling
- discourse
- Denial of service
- CVSS 8.8 High
Discourse vulnerable to Cross-site Scripting in local oneboxes
- discourse
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Discourse vulnerable to Cross-site Scripting through tag descriptions
- discourse
- Cross-site scripting (XSS)