Filter
AND
-Infinity
0
Trending
DiscourseCross-site Scripting (XSS) via topic titles when CSP disabled in Discourse
4.3
First published (updated )
DiscoursePartial denial of service via inline oneboxes in Discourse
4.3
First published (updated )
DiscoursePotential bypass of chat permissions in Discourse
4.3
First published (updated )
DiscourseHTMLi(XSS without CSP) via Onebox urls in Discourse
6.5
First published (updated )
DiscourseStored DOM-based XSS (without CSP) via video placeholders in Discourse
6.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
DiscourseBypass of Discourse Connect using other login paths if enabled in Discourse
5.3
First published (updated )
DiscourseMagnific lightbox susceptible to Cross-site Scripting in Discourse
6.8
First published (updated )
DiscourseCross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse
6.5
First published (updated )
DiscoursePrevent topic list filtering by hidden tags for unauthorized users in Discourse
5.3
First published (updated )
Discourse Calendar pluginDiscourse Calendar plugin event names susceptible to XSS
6.1
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Discourse Calendar pluginInsufficient control of region value length in discourse-calendar
4.3
First published (updated )
DiscourseDiscourse allows iframe injection though default site setting
6.1
First published (updated )
DiscourseDenial of service via Watched Words in Discourse
4.9
First published (updated )
DiscourseDiscourse vulnerable to Server-Side Request Forgery via FastImage
6.4
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
DiscourseDiscourse doesn't limit reviewable user serializer payload
4.3
First published (updated )
DiscourseDiscourse missing authorization checks for suspending admins/moderators
6.5
First published (updated )
DiscourseDiscourse vulnerable to stored-dom XSS via Facebook Oneboxes
6.1
First published (updated )
DiscourseWordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerability
4.3
First published (updated )
DiscourseDenial of service through invites in Discourse
6.5
EPSS
0.04%
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
DiscourseDenial of service via Staff Actions in Discourse
6.5
EPSS
0.04%
First published (updated )
DiscourseDisclosure of the existence of secret categories with custom backgrounds in Discourse
5.3
EPSS
0.04%
First published (updated )
DiscourseDisclosure of the existence of secret subcategories in Discourse
5.3
First published (updated )
DiscourseNo rate limits on POST /uploads endpoint in Discourse
5.3
EPSS
0.04%
First published (updated )
Discourse Calendar pluginUser can see invitees in events created in PMs and private categories
5.3
EPSS
0.04%
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Discourse Calendar pluginUninvited user is able to join and mark the attendance of the the private event
6.5
EPSS
0.04%
First published (updated )
Discourse Group Membership Ip Blocksdiscourse-group-membership-ip-block is exposing potentially sensitive custom fields
5.3
EPSS
0.05%
First published (updated )
DiscourseDiscourse improperly sanitized user input leads to XSS
6.3
EPSS
0.05%
First published (updated )
DiscourseDiscourse secure uploads accessible to guests even when login is required
4.3
First published (updated )
DiscourseInsufficient control of custom field value sizes
4.3
EPSS
0.04%
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.