Discourse discourse

• CVE-2025-24972 Medium 4.3 Discourse may bypass user preference when adding users to chat groups 0.4%
• CVE-2025-24808 Medium 4.3 Discourse has race condition when adding users to a group DM 0.2%
• CVE-2024-53266 Medium 4.3 Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse 0.3%
• CVE-2024-53851 Medium 4.3 Partial denial of service via inline oneboxes in Discourse 0.5%
• CVE-2024-53994 Medium 4.3 Potential bypass of chat permissions in Discourse 0.3%
• CVE-2024-55948 High 8.2 Anonymous cache poisoning via XHR requests in Discourse 0.3%
• CVE-2024-56197 Low 2.2 Users can see other user's tagged PMs in Discourse 0.4%
• CVE-2024-56328 Medium 6.5 HTMLi(XSS without CSP) via Onebox urls in Discourse 0.4%
• CVE-2025-22601 Low 3.1 Client Side Path Traversal using activate account route in Discourse 0.4%
• CVE-2025-22602 Medium 6.5 Stored DOM-based XSS (without CSP) via video placeholders in Discourse 0.4%
• CVE-2025-23023 High 8.2 Anonymous cache poisoning via request headers in Discourse 0.3%
• CVE-2024-49765 Medium 5.3 Bypass of Discourse Connect using other login paths if enabled in Discourse 0.4%
• CVE-2024-52589 Low 2.2 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse 0.3%
• CVE-2024-52794 Medium 6.8 Magnific lightbox susceptible to Cross-site Scripting in Discourse 0.3%
• CVE-2024-53991 High 7.5 Potential Backup file leaked via Nginx in Discourse 29.9%
• CVE-2024-47773 High 8.2 Anonymous cache poisoning via XHR requests in Discourse 1.8%
• CVE-2024-47772 Medium 6.5 Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse 0.3%
• CVE-2024-43789 High 7.5 Denial of service by the absence of restrictions on replies to posts in Discourse 0.5%
• CVE-2024-45297 Medium 5.3 Prevent topic list filtering by hidden tags for unauthorized users in Discourse 0.3%
• CVE-2024-45051 High 8.2 Bypass of email address validation via encoded email addresses in Discourse 0.4%
• CVE-2024-39320 Medium 6.1 Discourse allows iframe injection though default site setting 0.3%
• CVE-2024-37299 Medium 4.9 Discourse vulnerable to DoS via Tag Group 0.6%
• CVE-2024-37165 Medium 6.3 Discourse has an XSS via Onebox system 0.4%
• CVE-2024-38360 Medium 4.9 Denial of service via Watched Words in Discourse 0.5%
• CVE-2024-37157 Medium 6.4 Discourse vulnerable to Server-Side Request Forgery via FastImage 0.3%
• CVE-2024-36122 Low 2.4 Discourse doesn't limit reviewable user serializer payload 0.4%
• CVE-2024-36113 Medium 4.9 Discourse missing authorization checks for suspending admins/moderators 0.4%
• CVE-2024-35234 Medium 4.2 Discourse vulnerable to stored-dom XSS via Facebook Oneboxes 0.3%
• CVE-2024-35227 High 7.5 Discourse vulnerable to DoS through Onebox 0.6%
• CVE-2024-27085 Medium 6.5 Denial of service through invites in Discourse 0.6%
• CVE-2024-27100 Medium 6.5 Denial of service via Staff Actions in Discourse 0.6%
• CVE-2024-28242 Medium 5.3 Disclosure of the existence of secret categories with custom backgrounds in Discourse 0.5%
• CVE-2024-24748 Medium 5.3 Disclosure of the existence of secret subcategories in Discourse 0.5%
• CVE-2024-24827 Medium 5.3 No rate limits on POST /uploads endpoint in Discourse 0.6%
• CVE-2024-23834 Medium 6.3 Discourse improperly sanitized user input leads to XSS 0.5%
• CVE-2023-49099 Low 3.1 Discourse secure uploads accessible to guests even when login is required 0.3%
• CVE-2024-21655 Medium 4.3 Insufficient control of custom field value sizes 0.6%
• CVE-2023-48297 High 8.6 Discourse vulnerable to unlimited mentioned users in message serializer 0.5%
• CVE-2023-47121 Low 3.4 Discourse SSRF vulnerability in Embedding 0.7%
• CVE-2023-47120 High 7.5 Discourse DoS through Onebox favicon URL 1.0%
• CVE-2023-47119 Medium 5.3 HTML injection in oneboxed links 0.9%
• CVE-2023-46130 Medium 4.3 Bypassing height value allowed in some theme components 0.7%
• CVE-2023-45816 Low 3.3 Unread bookmark reminder notifications that the user cannot access can be seen 0.3%
• CVE-2023-45806 Medium 4.3 Discourse vulnerable to DoS via Regexp Injection in Full Name 1.0%
• CVE-2023-45131 High 7.5 Unauthenticated access to new private chat messages in Discourse 4.0%
• CVE-2023-44391 Medium 5.3 Prevent unauthorized access to summary details in Discourse 0.5%
• CVE-2023-44388 High 7.5 Malicious requests can fill up the log files resulting in a deinal of service in Discourse 0.6%
• CVE-2023-43814 Low 3.7 Exposure of poll options and votes to unauthorized users in Discourse 0.4%
• CVE-2023-43659 High 8.0 Cross-site Scripting via email preview when CSP disabled in Discourse 0.5%
• CVE-2023-45147 Medium 4.9 Arbitrary keys can be added to a topic's custom fields by any user in Discourse 0.3%