discourse kayıtları
discourse üreticisine ait 290 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 6
- Düzeltme kaydı olan
- %19,7
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor74
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')44
- CWE-862 Missing Authorization21
- CWE-863 Incorrect Authorization20
- CWE-400 Uncontrolled Resource Consumption16
- CWE-770 Allocation of Resources Without Limits or Throttling15
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWEBug bounty kapsamı
Ürünün üreticisi herkese açık bir programda görünüyor. Eşleşme ad üzerinden yapıldı; kapsam metnini programda doğrulayın.
Tüm kayıtlar
290 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
45Planlayın | CVE-2021-41163İstismar yok | RCE via malicious SNS subscription payloaddiscourse · discourse · CWE-74 | Kritik9,8 | — | %19,8 | 20 Eki 2021 |
39İzleyin | CVE-2022-46162İstismar yok | Discourse BBCode plugin vulnerable to arbitrary CSS injectiondiscourse · discourse bbcode · CWE-74 | Kritik9,8 | — | %1,1 | 30 Kas 2022 |
39İzleyin | CVE-2022-39355İstismar yok | Discourse Patreon vulnerable to improper validation of email during Patreon authenticationdiscourse · patreon · CWE-287 | Kritik9,8 | — | %0,8 | 26 Eki 2022 |
39İzleyin | CVE-2023-47121İstismar yok | Discourse SSRF vulnerability in Embeddingdiscourse · discourse · CWE-918 | Kritik9,8 | — | %0,7 | 10 Kas 2023 |
39İzleyin | CVE-2025-68662İstismar yok | FinalDestination hostname matching allows SSRF protection bypassdiscourse · discourse · CWE-918 | Kritik9,9 | — | %0,3 | 28 Oca 2026 |
36İzleyin | CVE-2026-53963İstismar yok | Discourse: Stored-XSS in 2FA delete confirmation modaldiscourse · discourse · CWE-79 | Kritik9,0 | — | %0,7 | 9 Tem 2026 |
36İzleyin | CVE-2024-49765İstismar yok | Bypass of Discourse Connect using other login paths if enabled in Discoursediscourse · discourse · CWE-359 | Kritik9,1 | — | %0,4 | 19 Ara 2024 |
35İzleyin | CVE-2022-21684İstismar yok | User can bypass approval when invited to Discoursediscourse · discourse · CWE-287 | Yüksek8,8 | — | %0,8 | 13 Oca 2022 |
35İzleyin | CVE-2021-41263İstismar yok | Secure/signed cookies share secrets between sites in rails_multisitediscourse · rails multisite · CWE-200 | Yüksek8,8 | — | %0,6 | 15 Kas 2021 |
35İzleyin | CVE-2022-39356İstismar yok | Discourse user account takeover via email and invite linkdiscourse · discourse · CWE-285 | Yüksek8,8 | — | %0,6 | 2 Kas 2022 |
34İzleyin | CVE-2026-27934İstismar yok | Discourse leaks private topic title and post excerpt via user action API endpointdiscourse · discourse · CWE-201 | Yüksek8,7 | — | %0,4 | 19 Mar 2026 |
34İzleyin | CVE-2025-48053İstismar yok | Discourse vulnerable to DoS via large URL payload in PM to a botdiscourse · discourse · CWE-400 | Yüksek8,7 | — | %0,4 | 9 Haz 2025 |
32İzleyin | CVE-2024-53991Kavram kanıtı | Potential Backup file leaked via Nginx in Discoursediscourse · discourse · CWE-200 | Orta5,9 | — | %29,9 | 19 Ara 2024 |
32İzleyin | CVE-2024-47773Kavram kanıtı | Anonymous cache poisoning via XHR requests in Discoursediscourse · discourse · CWE-610 | Yüksek8,2 | — | %1,7 | 8 Eki 2024 |
32İzleyin | CVE-2023-46241İstismar yok | Potential account take over due to unverified emails from Microsoft Identity Platformdiscourse · microsoft authentication · CWE-863 | Yüksek8,1 | — | %0,8 | 21 Şub 2024 |
32İzleyin | CVE-2022-46177İstismar yok | Discourse password reset link can lead to in account takeover if user changes to a new emaildiscourse · discourse · CWE-613 | Yüksek8,1 | — | %0,7 | 5 Oca 2023 |
32İzleyin | CVE-2026-55420İstismar yok | Discourse: Remote code execution via pdf uploadsdiscourse · discourse · CWE-78 | Yüksek8,1 | — | %0,6 | 9 Tem 2026 |
32İzleyin | CVE-2023-28112İstismar yok | Discourse's SSRF protection missing for some FastImage requestsdiscourse · discourse · CWE-918 | Yüksek8,1 | — | %0,6 | 17 Mar 2023 |
32İzleyin | CVE-2025-53102İstismar yok | Discourse's WebAuthn challenge isn't cleared from user session after authenticationdiscourse · discourse · CWE-384 | Yüksek8,2 | — | %0,5 | 29 Tem 2025 |
32İzleyin | CVE-2025-48877İstismar yok | Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframediscourse · discourse · CWE-1038 | Yüksek8,1 | — | %0,4 | 9 Haz 2025 |
32İzleyin | CVE-2026-31805İstismar yok | Discourse has a poll authorization bypass via post_id array parameterdiscourse · discourse · CWE-20 | Yüksek8,2 | — | %0,4 | 19 Mar 2026 |
32İzleyin | CVE-2024-45051İstismar yok | Bypass of email address validation via encoded email addresses in Discoursediscourse · discourse · CWE-287 | Yüksek8,2 | — | %0,4 | 7 Eki 2024 |
32İzleyin | CVE-2026-29072İstismar yok | Discourse missing permission check for policy creation in discourse-policydiscourse · discourse · CWE-862 | Yüksek8,2 | — | %0,3 | 19 Mar 2026 |
32İzleyin | CVE-2025-23023İstismar yok | Anonymous cache poisoning via request headers in Discoursediscourse · discourse · CWE-346 | Yüksek8,2 | — | %0,3 | 4 Şub 2025 |
32İzleyin | CVE-2024-55948İstismar yok | Anonymous cache poisoning via XHR requests in Discoursediscourse · discourse · CWE-346 | Yüksek8,2 | — | %0,3 | 4 Şub 2025 |
- CVE-2021-4116345Planlayın
RCE via malicious SNS subscription payload
KritikCVSS 9,8İstismar yokEPSS %20discourse · discourse20 Eki 2021
- CVE-2022-4616239İzleyin
Discourse BBCode plugin vulnerable to arbitrary CSS injection
KritikCVSS 9,8İstismar yokEPSS %1discourse · discourse bbcode30 Kas 2022
- CVE-2022-3935539İzleyin
Discourse Patreon vulnerable to improper validation of email during Patreon authentication
KritikCVSS 9,8İstismar yokEPSS %1discourse · patreon26 Eki 2022
- CVE-2023-4712139İzleyin
Discourse SSRF vulnerability in Embedding
KritikCVSS 9,8İstismar yokEPSS %1discourse · discourse10 Kas 2023
- CVE-2025-6866239İzleyin
FinalDestination hostname matching allows SSRF protection bypass
KritikCVSS 9,9İstismar yokEPSS %0discourse · discourse28 Oca 2026
- CVE-2026-5396336İzleyin
Discourse: Stored-XSS in 2FA delete confirmation modal
KritikCVSS 9,0İstismar yokEPSS %1discourse · discourse9 Tem 2026
- CVE-2024-4976536İzleyin
Bypass of Discourse Connect using other login paths if enabled in Discourse
KritikCVSS 9,1İstismar yokEPSS %0discourse · discourse19 Ara 2024
- CVE-2022-2168435İzleyin
User can bypass approval when invited to Discourse
YüksekCVSS 8,8İstismar yokEPSS %1discourse · discourse13 Oca 2022
- CVE-2021-4126335İzleyin
Secure/signed cookies share secrets between sites in rails_multisite
YüksekCVSS 8,8İstismar yokEPSS %1discourse · rails multisite15 Kas 2021
- CVE-2022-3935635İzleyin
Discourse user account takeover via email and invite link
YüksekCVSS 8,8İstismar yokEPSS %1discourse · discourse2 Kas 2022
- CVE-2026-2793434İzleyin
Discourse leaks private topic title and post excerpt via user action API endpoint
YüksekCVSS 8,7İstismar yokEPSS %0discourse · discourse19 Mar 2026
- CVE-2025-4805334İzleyin
Discourse vulnerable to DoS via large URL payload in PM to a bot
YüksekCVSS 8,7İstismar yokEPSS %0discourse · discourse9 Haz 2025
- CVE-2024-5399132İzleyin
Potential Backup file leaked via Nginx in Discourse
OrtaCVSS 5,9Kavram kanıtıEPSS %30discourse · discourse19 Ara 2024
- CVE-2024-4777332İzleyin
Anonymous cache poisoning via XHR requests in Discourse
YüksekCVSS 8,2Kavram kanıtıEPSS %2discourse · discourse8 Eki 2024
- CVE-2023-4624132İzleyin
Potential account take over due to unverified emails from Microsoft Identity Platform
YüksekCVSS 8,1İstismar yokEPSS %1discourse · microsoft authentication21 Şub 2024
- CVE-2022-4617732İzleyin
Discourse password reset link can lead to in account takeover if user changes to a new email
YüksekCVSS 8,1İstismar yokEPSS %1discourse · discourse5 Oca 2023
- CVE-2026-5542032İzleyin
Discourse: Remote code execution via pdf uploads
YüksekCVSS 8,1İstismar yokEPSS %1discourse · discourse9 Tem 2026
- CVE-2023-2811232İzleyin
Discourse's SSRF protection missing for some FastImage requests
YüksekCVSS 8,1İstismar yokEPSS %1discourse · discourse17 Mar 2023
- CVE-2025-5310232İzleyin
Discourse's WebAuthn challenge isn't cleared from user session after authentication
YüksekCVSS 8,2İstismar yokEPSS %0discourse · discourse29 Tem 2025
- CVE-2025-4887732İzleyin
Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe
YüksekCVSS 8,1İstismar yokEPSS %0discourse · discourse9 Haz 2025
- CVE-2026-3180532İzleyin
Discourse has a poll authorization bypass via post_id array parameter
YüksekCVSS 8,2İstismar yokEPSS %0discourse · discourse19 Mar 2026
- CVE-2024-4505132İzleyin
Bypass of email address validation via encoded email addresses in Discourse
YüksekCVSS 8,2İstismar yokEPSS %0discourse · discourse7 Eki 2024
- CVE-2026-2907232İzleyin
Discourse missing permission check for policy creation in discourse-policy
YüksekCVSS 8,2İstismar yokEPSS %0discourse · discourse19 Mar 2026
- CVE-2025-2302332İzleyin
Anonymous cache poisoning via request headers in Discourse
YüksekCVSS 8,2İstismar yokEPSS %0discourse · discourse4 Şub 2025
- CVE-2024-5594832İzleyin
Anonymous cache poisoning via XHR requests in Discourse
YüksekCVSS 8,2İstismar yokEPSS %0discourse · discourse4 Şub 2025