Corrigé dans
CVE affectant 3.4
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2025-68662 | FinalDestination hostname matching allows SSRF protection bypass | 9.9 | — | 2026-01-28 | |
| CVE-2024-49765 | Bypass of Discourse Connect using other login paths if enabled in Discourse | 9.1 | — | 2024-12-19 | |
| CVE-2025-48053 | Discourse vulnerable to DoS via large URL payload in PM to a bot | 8.7 | — | 2025-06-09 | |
| CVE-2025-53102 | Discourse's WebAuthn challenge isn't cleared from user session after authentication | 8.2 | — | 2025-07-29 | |
| CVE-2024-45051 | Bypass of email address validation via encoded email addresses in Discourse | 8.2 | — | 2024-10-07 | |
| CVE-2025-48877 | Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe | 8.1 | — | 2025-06-09 | |
| CVE-2026-26265 | Discourse has IDOR vulnerability in the directory items endpoint | 7.5 | — | 2026-02-26 | |
| CVE-2025-46813 | Private data leak on login-required Discourse sites | 7.5 | — | 2025-05-05 | |
| CVE-2026-26078 | Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint | 7.5 | — | 2026-02-26 | |
| CVE-2021-41082 | Private message title and participating users leaked in discourse | 7.5 | — | 2021-09-20 | |
| CVE-2026-44786 | Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users | 7.5 | — | 2026-06-12 | |
| CVE-2025-69218 | Discourse moderators can access admin-only reports exposing private upload URLs | 7.1 | — | 2026-01-28 | |
| CVE-2026-27021 | Discourse: Poll voters endpoint lacked post visibility checks | 6.9 | — | 2026-02-26 | |
| CVE-2026-23743 | Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized users | 6.9 | — | 2026-01-28 | |
| CVE-2026-45775 | Discourse: Cross-site backup access via path traversal in multisite local backups | 6.8 | — | 2026-06-12 | |
| CVE-2026-44784 | Discourse: Non-staff group owners can see email password in plaintext through group history | 6.5 | — | 2026-06-12 | |
| CVE-2025-68934 | Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint | 6.5 | — | 2026-01-28 | |
| CVE-2026-24742 | Discourse staff action logs expose sensitive information to moderators | 6.5 | — | 2026-01-28 | |
| CVE-2024-53851 | Partial denial of service via inline oneboxes in Discourse | 6.5 | — | 2025-02-04 | |
| CVE-2026-21865 | Discourse topic conversion permission vulnerability for moderators | 6.5 | — | 2026-01-28 | |
| CVE-2026-26077 | Discourse doesn't ensure webhooks require a token | 6.5 | — | 2026-02-26 | |
| CVE-2025-64528 | Users are able to find users by name even when `enable_names` is off | 6.3 | — | 2025-12-30 | |
| CVE-2025-49845 | Discourse users are able to see their own whispers even after being removed from a group that has been configu... | 6.3 | — | 2025-06-25 | |
| CVE-2025-61598 | Discourse is missing Cache-Control response header on error responses | 6.3 | — | 2025-10-28 | |
| CVE-2025-66488 | Discourse allows script execution in uploaded HTML/XML files on S3 | 6.1 | — | 2026-01-28 | |
| CVE-2024-56328 | HTMLi(XSS without CSP) via Onebox urls in Discourse | 6.1 | — | 2025-02-04 | |
| CVE-2025-22602 | Stored DOM-based XSS (without CSP) via video placeholders in Discourse | 6.1 | — | 2025-02-04 | |
| CVE-2024-47772 | Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse | 6.1 | — | 2024-10-07 | |
| CVE-2025-48062 | Discourse vulnerable to HTML injection when inviting to topic via email | 6.1 | — | 2025-06-09 | |
| CVE-2025-48954 | Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow | 6.1 | — | 2025-06-25 | |
| CVE-2024-52794 | Magnific lightbox susceptible to Cross-site Scripting in Discourse | 6.1 | — | 2024-12-19 | |
| CVE-2024-53991 | Potential Backup file leaked via Nginx in Discourse | 5.9 | — | 2024-12-19 | |
| CVE-2025-68666 | Discourse users archives leaked to users with moderation privileges | 5.9 | — | 2026-01-28 | |
| CVE-2025-59337 | Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments | 5.5 | — | 2025-10-01 | |
| CVE-2026-44783 | Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts | 5.4 | — | 2026-06-12 | |
| CVE-2025-58054 | Discourse is vulnerable to XSS when quoting chat messages | 5.4 | — | 2025-10-01 | |
| CVE-2026-26207 | DIscourse's discourse-policy plugin lacks post access check | 5.4 | — | 2026-02-26 | |
| CVE-2024-53266 | Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse | 5.4 | — | 2025-02-04 | |
| CVE-2026-27166 | Discourse vulnerable to HTML injection via prohibited iframe URLs | 5.4 | — | 2026-03-19 | |
| CVE-2025-68933 | Discourse non-admin moderators can exfiltrate private content via post ownership transfer | 5.4 | — | 2026-01-28 | |
| CVE-2025-67723 | Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin | 5.4 | — | 2026-01-28 | |
| CVE-2026-28218 | Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution | 5.3 | — | 2026-02-26 | |
| CVE-2025-68659 | Discourse has DoS vulnerability in username change endpoint | 5.3 | — | 2026-01-28 | |
| CVE-2025-68660 | Discourse AI Discover's continue conversation allows threat actor to impersonate user | 5.3 | — | 2026-01-28 | |
| CVE-2026-47264 | Discourse: Don't leak restricted tag group names via tag info | 5.3 | — | 2026-06-12 | |
| CVE-2026-45085 | Discourse: Chat misauthorization and information disclosure | 5.3 | — | 2026-06-12 | |
| CVE-2025-68479 | Discourse subscriptions are susceptible to takeover | 5.3 | — | 2026-01-28 | |
| CVE-2025-69289 | Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff accoun... | 5.1 | — | 2026-01-28 | |
| CVE-2026-27149 | Discourse has SQL injection in PM tag filtering | 4.9 | — | 2026-02-26 | |
| CVE-2024-56197 | Users can see other user's tagged PMs in Discourse | 4.9 | — | 2025-02-04 | |
| CVE-2026-27162 | DIscourse doesn't prevent whispers to leak in excerpts | 4.9 | — | 2026-02-26 | |
| CVE-2025-32376 | Discourse DM limits aren’t always properly enforced | 4.8 | — | 2025-04-30 | |
| CVE-2025-24972 | Discourse may bypass user preference when adding users to chat groups | 4.3 | — | 2025-03-26 | |
| CVE-2026-44785 | Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts | 4.3 | — | 2026-06-12 | |
| CVE-2025-58055 | Discourse AI Suggestions Contain Insecure Direct Object Reference | 4.3 | — | 2025-10-01 | |
| CVE-2024-43789 | Denial of service by the absence of restrictions on replies to posts in Discourse | 4.3 | — | 2024-10-07 | |
| CVE-2026-47263 | Discourse: Prevent webhook payload disclosure on event redelivery | 4.3 | — | 2026-06-12 | |
| CVE-2026-26973 | Discourse doesn't scope reviewable notes to user-visible reviewables | 4.3 | — | 2026-02-26 | |
| CVE-2026-44779 | Discourse: Bot debug endpoints disclose whisper translation audit logs | 4.3 | — | 2026-06-12 | |
| CVE-2024-45297 | Prevent topic list filtering by hidden tags for unauthorized users in Discourse | 4.3 | — | 2024-10-07 | |
| CVE-2026-44782 | Discourse: GroupPostSerializer leaks hidden full names through reaction post association | 4.3 | — | 2026-06-12 | |
| CVE-2024-53994 | Potential bypass of chat permissions in Discourse | 4.3 | — | 2025-02-04 | |
| CVE-2026-44780 | Discourse: Category queue reviewers can read raw incoming emails from queued posts | 4.3 | — | 2026-06-12 | |
| CVE-2025-24808 | Discourse has race condition when adding users to a group DM | 3.1 | — | 2025-03-26 | |
| CVE-2025-22601 | Client Side Path Traversal using activate account route in Discourse | 3.1 | — | 2025-02-04 | |
| CVE-2024-52589 | Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse | 2.7 | — | 2024-12-19 | |
| CVE-2025-54411 | Discourse welcome banner user name XSS | 2.4 | — | 2025-08-19 | |
| CVE-2026-27153 | Discourse doesn't prevent moderators from exporting user Chat DMs | 1.3 | — | 2026-02-26 | |
| CVE-2026-27152 | DIscourse has DM communication-preference bypass when adding members | 1.3 | — | 2026-02-26 | |
| CVE-2026-27150 | Discourse doesn't ensure guardian check when creating QueryGroupBookmark | 1.3 | — | 2026-02-26 | |
| CVE-2026-28219 | Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners | 1.3 | — | 2026-02-26 | |
| CVE-2026-27154 | Discourse has XSS when editing a malicious post | 1.3 | — | 2026-02-26 | |
| CVE-2026-27151 | Discourse doesn't validate destination topic when moving posts | 1.3 | — | 2026-02-26 | |
| CVE-2026-28227 | Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_catego... | 1.2 | — | 2026-02-26 | |
| CVE-2026-26979 | Discourse: TL4 users are able to change status of restricted topics | 0.0 | — | 2026-02-26 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).