agentprime: discourseEvery new CVE for discourse.https://agentprime.io/CVE-2017-20290: Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribedhttps://agentprime.io/advisories/CVE-2017-20290/https://agentprime.io/advisories/CVE-2017-20290/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 10:57:24 GMTCVECVE-2026-91157: Discourse: Media uploads remain publicly accessible after category permissions are restrictedhttps://agentprime.io/advisories/CVE-2026-91157/https://agentprime.io/advisories/CVE-2026-91157/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 15:37:02 GMTCVECVE-2026-91156: Discourse: Chat MessageBus delivers read-restricted messages to unauthorized usershttps://agentprime.io/advisories/CVE-2026-91156/https://agentprime.io/advisories/CVE-2026-91156/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 15:33:33 GMTCVECVE-2026-91159: Discourse: Stored oEmbed HTML injection via allowed iframehttps://agentprime.io/advisories/CVE-2026-91159/https://agentprime.io/advisories/CVE-2026-91159/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 15:30:14 GMTCVECVE-2026-91119: Discourse: Encode action_code_who in mention URLshttps://agentprime.io/advisories/CVE-2026-91119/https://agentprime.io/advisories/CVE-2026-91119/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 17:07:04 GMTCVECVE-2026-91121: Discourse: Chat upload filenames rendered as raw HTML in excerptshttps://agentprime.io/advisories/CVE-2026-91121/https://agentprime.io/advisories/CVE-2026-91121/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 17:05:20 GMTCVECVE-2026-91120: Discourse: Stored HTML injection in video notification emailshttps://agentprime.io/advisories/CVE-2026-91120/https://agentprime.io/advisories/CVE-2026-91120/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 17:00:05 GMTCVECVE-2026-91132: Discourse: Wildcard iframe origin allowlist bypass via authority separatorshttps://agentprime.io/advisories/CVE-2026-91132/https://agentprime.io/advisories/CVE-2026-91132/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:57:43 GMTCVECVE-2026-91122: Discourse: Chat MessageBus delivers read-restricted messages to unauthorized usershttps://agentprime.io/advisories/CVE-2026-91122/https://agentprime.io/advisories/CVE-2026-91122/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:56:26 GMTCVECVE-2026-91123: Discourse: Reject literal backslash path separators in iframe src traversal guardhttps://agentprime.io/advisories/CVE-2026-91123/https://agentprime.io/advisories/CVE-2026-91123/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:54:59 GMTCVECVE-2026-91133: Discourse: Escape LIKE metacharacters in upload paths to prevent disclosurehttps://agentprime.io/advisories/CVE-2026-91133/https://agentprime.io/advisories/CVE-2026-91133/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:53:00 GMTCVECVE-2026-91134: Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlisthttps://agentprime.io/advisories/CVE-2026-91134/https://agentprime.io/advisories/CVE-2026-91134/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:51:34 GMTCVECVE-2026-84302: Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewableshttps://agentprime.io/advisories/CVE-2026-84302/https://agentprime.io/advisories/CVE-2026-84302/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:49:56 GMTCVECVE-2026-59830: Discourse: Stored XSS via unescaped actor name in post actionshttps://agentprime.io/advisories/CVE-2026-59830/https://agentprime.io/advisories/CVE-2026-59830/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 21:17:38 GMTCVECVE-2026-53960: Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LDhttps://agentprime.io/advisories/CVE-2026-53960/https://agentprime.io/advisories/CVE-2026-53960/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 15:33:14 GMTCVECVE-2026-55704: Discourse: Shared-draft titles and excerpts leak through group post serializationhttps://agentprime.io/advisories/CVE-2026-55704/https://agentprime.io/advisories/CVE-2026-55704/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 15:31:41 GMTCVECVE-2026-55674: Discourse: Cache poisoning/XSS via color scheme cookieshttps://agentprime.io/advisories/CVE-2026-55674/https://agentprime.io/advisories/CVE-2026-55674/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 15:30:17 GMTCVEcriticalCVE-2026-59829: Discourse: Review queue exposes flag-related private message excerpts to category group moderatorshttps://agentprime.io/advisories/CVE-2026-59829/https://agentprime.io/advisories/CVE-2026-59829/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 15:26:53 GMTCVECVE-2026-72732: Discourse: Templates endpoint exposes hidden tag nameshttps://agentprime.io/advisories/CVE-2026-72732/https://agentprime.io/advisories/CVE-2026-72732/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:18:00 GMTCVECVE-2026-72731: Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorerhttps://agentprime.io/advisories/CVE-2026-72731/https://agentprime.io/advisories/CVE-2026-72731/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 16:25:23 GMTCVECVE-2026-72730: Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editorhttps://agentprime.io/advisories/CVE-2026-72730/https://agentprime.io/advisories/CVE-2026-72730/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 16:17:04 GMTCVECVE-2026-72729: Discourse: Stored XSS in discourse-local-dates pluginhttps://agentprime.io/advisories/CVE-2026-72729/https://agentprime.io/advisories/CVE-2026-72729/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 16:15:13 GMTCVECVE-2026-72728: Discourse: Onebox iframe origin allowlist enforces URL authority boundaryhttps://agentprime.io/advisories/CVE-2026-72728/https://agentprime.io/advisories/CVE-2026-72728/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 16:13:20 GMTCVECVE-2026-72727: Discourse: Stored XSS in the moderation review queuehttps://agentprime.io/advisories/CVE-2026-72727/https://agentprime.io/advisories/CVE-2026-72727/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 16:08:21 GMTCVECVE-2026-72726: Discourse: Unauthorized eavesdropping on private AI bot conversations.https://agentprime.io/advisories/CVE-2026-72726/https://agentprime.io/advisories/CVE-2026-72726/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 16:05:11 GMTCVECVE-2026-72725: Discourse: Stored XSS in staff action logs injects staff UIhttps://agentprime.io/advisories/CVE-2026-72725/https://agentprime.io/advisories/CVE-2026-72725/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 16:02:56 GMTCVECVE-2026-72724: Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatchhttps://agentprime.io/advisories/CVE-2026-72724/https://agentprime.io/advisories/CVE-2026-72724/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 15:59:53 GMTCVECVE-2026-72723: Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tagshttps://agentprime.io/advisories/CVE-2026-72723/https://agentprime.io/advisories/CVE-2026-72723/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 15:56:53 GMTCVECVE-2026-72722: Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLshttps://agentprime.io/advisories/CVE-2026-72722/https://agentprime.io/advisories/CVE-2026-72722/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 15:54:35 GMTCVECVE-2026-72721: Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparisonhttps://agentprime.io/advisories/CVE-2026-72721/https://agentprime.io/advisories/CVE-2026-72721/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 15:48:30 GMTCVECVE-2026-72720: Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsinghttps://agentprime.io/advisories/CVE-2026-72720/https://agentprime.io/advisories/CVE-2026-72720/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 15:41:51 GMTCVECVE-2026-45780: Discourse: Private event sample invitees are serialized to non-invited event viewershttps://agentprime.io/advisories/CVE-2026-45780/https://agentprime.io/advisories/CVE-2026-45780/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 22:08:52 GMTCVECVE-2026-53963: Discourse: Stored-XSS in 2FA delete confirmation modalhttps://agentprime.io/advisories/CVE-2026-53963/https://agentprime.io/advisories/CVE-2026-53963/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 22:05:46 GMTCVECVE-2026-59828: Discourse: Hidden post revisions leak through adjacent visible diffshttps://agentprime.io/advisories/CVE-2026-59828/https://agentprime.io/advisories/CVE-2026-59828/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 22:04:50 GMTCVECVE-2026-44787: Discourse: Signup-time primary_group_id assignment grants whisperer accesshttps://agentprime.io/advisories/CVE-2026-44787/https://agentprime.io/advisories/CVE-2026-44787/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 22:03:41 GMTCVECVE-2026-53962: Discourse: Insufficient SVG sanitization logichttps://agentprime.io/advisories/CVE-2026-53962/https://agentprime.io/advisories/CVE-2026-53962/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 22:02:27 GMTCVECVE-2026-55424: Discourse: Topic featured link susceptible to stored XSShttps://agentprime.io/advisories/CVE-2026-55424/https://agentprime.io/advisories/CVE-2026-55424/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 22:01:22 GMTCVECVE-2026-45788: Discourse: Secure uploads exposed by hotlinked image copyinghttps://agentprime.io/advisories/CVE-2026-45788/https://agentprime.io/advisories/CVE-2026-45788/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 21:59:27 GMTCVECVE-2026-49256: Discourse: Hidden tag names leaked via category serializershttps://agentprime.io/advisories/CVE-2026-49256/https://agentprime.io/advisories/CVE-2026-49256/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 21:56:40 GMTCVECVE-2026-46413: Discourse: Regular users can route multipart uploads into the admin backup storehttps://agentprime.io/advisories/CVE-2026-46413/https://agentprime.io/advisories/CVE-2026-46413/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 21:55:45 GMTCVECVE-2026-53961: Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)https://agentprime.io/advisories/CVE-2026-53961/https://agentprime.io/advisories/CVE-2026-53961/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 21:48:11 GMTCVECVE-2026-55420: Discourse: Remote code execution via pdf uploadshttps://agentprime.io/advisories/CVE-2026-55420/https://agentprime.io/advisories/CVE-2026-55420/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 17:54:07 GMTCVECVE-2026-47264: Discourse: Don't leak restricted tag group names via tag infohttps://agentprime.io/advisories/CVE-2026-47264/https://agentprime.io/advisories/CVE-2026-47264/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 20:26:38 GMTCVECVE-2026-47263: Discourse: Prevent webhook payload disclosure on event redeliveryhttps://agentprime.io/advisories/CVE-2026-47263/https://agentprime.io/advisories/CVE-2026-47263/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 20:26:19 GMTCVECVE-2026-45775: Discourse: Cross-site backup access via path traversal in multisite local backupshttps://agentprime.io/advisories/CVE-2026-45775/https://agentprime.io/advisories/CVE-2026-45775/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 20:25:33 GMTCVECVE-2026-45085: Discourse: Chat misauthorization and information disclosurehttps://agentprime.io/advisories/CVE-2026-45085/https://agentprime.io/advisories/CVE-2026-45085/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 20:25:09 GMTCVECVE-2026-44785: Discourse: Hidden reply-to post raw can be disclosed through AI explain promptshttps://agentprime.io/advisories/CVE-2026-44785/https://agentprime.io/advisories/CVE-2026-44785/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 20:24:39 GMTCVECVE-2026-44784: Discourse: Non-staff group owners can see email password in plaintext through group historyhttps://agentprime.io/advisories/CVE-2026-44784/https://agentprime.io/advisories/CVE-2026-44784/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 20:23:52 GMTCVECVE-2026-44783: Discourse: Replying to a whisper lets non-whisperers create staff-only whisper postshttps://agentprime.io/advisories/CVE-2026-44783/https://agentprime.io/advisories/CVE-2026-44783/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 20:23:14 GMTCVECVE-2026-44782: Discourse: GroupPostSerializer leaks hidden full names through reaction post associationhttps://agentprime.io/advisories/CVE-2026-44782/https://agentprime.io/advisories/CVE-2026-44782/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Jun 2026 20:23:01 GMTCVE