Discourse discourse

• CVE-2022-41944 Low 3.5 Discourse users can see notifications for topics they no longer have access to 0.5%
• CVE-2022-39385 Medium 6.5 Users erroneously and transparently added to private messages in Discourse 0.6%
• CVE-2022-39378 Medium 5.3 Displaying user badges can leak topic titles to users that have no access to the topic 0.6%
• CVE-2022-39356 High 8.9 Discourse user account takeover via email and invite link 0.7%
• CVE-2022-39241 High 7.6 Possible Server-Side Request Forgery (SSRF) in webhooks 0.6%
• CVE-2022-39232 Medium 6.5 Discourse vulnerable to incomplete quote causing a topic to crash in the browser 1.2%
• CVE-2022-39226 Medium 4.3 Discourse user profile location and website fields were not sufficiently length-limited 1.0%
• CVE-2022-36068 High 7.2 Discourse moderators can edit themes via the API 0.9%
• CVE-2022-36066 Critical 9.1 Discourse vulnerable to RCE via admins uploading maliciously zipped file 2.1%
• CVE-2022-31184 Medium 6.5 Email activation route can be abused by spammers in Discourse 0.7%
• CVE-2022-31182 Medium 5.3 Cache poisoning via maliciously-formed request in Discourse 0.8%
• CVE-2022-31096 Medium 5.7 Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse 0.5%
• CVE-2022-31060 Medium 5.3 Banner topic data is exposed on login-required Discourse sites 1.1%
• CVE-2022-31025 Low 2.6 Invite bypasses user approval in Discourse 1.0%
• CVE-2022-24850 Medium 5.3 Category group permissions leaked in Discourse 0.7%
• CVE-2022-24824 Medium 5.3 Anonymous user cache poisoning in discourse 1.0%
• CVE-2022-24804 Medium 5.3 Private group name exposure in discourse 0.9%
• CVE-2022-24782 Medium 4.3 Secure category names leaked via user activity export in Discourse 1.0%
• CVE-2022-23641 Medium 6.5 Denial of Service in Discourse 1.2%
• CVE-2022-21677 Medium 4.3 Group advanced search option may leak group and group's members visibility 1.2%
• CVE-2022-21684 Medium 4.3 User can bypass approval when invited to Discourse 0.9%
• CVE-2022-21678 Medium 4.3 User's bio visible even if profile is restricted in Discourse 0.8%
• CVE-2022-21642 Medium 4.3 Exposure of whisper participants in discourse 0.8%
• CVE-2021-43850 Medium 6.8 Denial of Service in discourse 0.9%
• CVE-2021-43793 Medium 4.3 Bypass of Poll voting limits in Discourse 0.8%
• CVE-2021-43794 Medium 5.3 Anonymous user cache poisoning via development-mode header in Discourse 1.1%
• CVE-2021-43792 Medium 4.3 Notifications leak in Discourse 0.9%
• CVE-2021-41271 Medium 4.8 Cache poisoning via maliciously-formed request in discourse 1.0%
• CVE-2021-41163 Critical 10.0 RCE via malicious SNS subscription payload 19.8%
• CVE-2021-41095 Medium 4.2 XSS via blocked watched word in error message 0.6%
• CVE-2021-41082 High 7.5 Private message title and participating users leaked in discourse 1.8%
• CVE-2021-39161 Medium 4.4 Cross-site scripting via category name in Discourse 0.4%
• CVE-2021-37703 Medium 4.3 Information exposure in Discourse 0.8%
• CVE-2021-37693 Medium 5.3 Re-use of email tokens in Discourse 0.8%
• CVE-2021-37633 High 7.4 XSS via d-popover and d-html-popover attribute 0.8%
• CVE-2021-32788 Medium 4.3 Post creator of a whisper post can be revealed to non-staff users in Discourse 0.9%
• CVE-2021-32764 High 8.1 YouTube Onebox susceptible to XSS 0.5%