1.6 에 영향을 주는 CVE
| CVE | 제목 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|
| CVE-2025-68662 | FinalDestination hostname matching allows SSRF protection bypass | 9.9 | — | 2026-01-28 | |
| CVE-2023-47121 | Discourse SSRF vulnerability in Embedding | 9.8 | — | 2023-11-10 | |
| CVE-2021-41163 | RCE via malicious SNS subscription payload | 9.8 | — | 2021-10-20 | |
| CVE-2024-49765 | Bypass of Discourse Connect using other login paths if enabled in Discourse | 9.1 | — | 2024-12-19 | |
| CVE-2022-39356 | Discourse user account takeover via email and invite link | 8.8 | — | 2022-11-02 | |
| CVE-2022-21684 | User can bypass approval when invited to Discourse | 8.8 | — | 2022-01-13 | |
| CVE-2025-48053 | Discourse vulnerable to DoS via large URL payload in PM to a bot | 8.7 | — | 2025-06-09 | |
| CVE-2025-53102 | Discourse's WebAuthn challenge isn't cleared from user session after authentication | 8.2 | — | 2025-07-29 | |
| CVE-2024-45051 | Bypass of email address validation via encoded email addresses in Discourse | 8.2 | — | 2024-10-07 | |
| CVE-2024-55948 | Anonymous cache poisoning via XHR requests in Discourse | 8.2 | — | 2025-02-04 | |
| CVE-2024-47773 | Anonymous cache poisoning via XHR requests in Discourse | 8.2 | — | 2024-10-08 | |
| CVE-2025-23023 | Anonymous cache poisoning via request headers in Discourse | 8.2 | — | 2025-02-04 | |
| CVE-2023-28112 | Discourse's SSRF protection missing for some FastImage requests | 8.1 | — | 2023-03-17 | |
| CVE-2022-46177 | Discourse password reset link can lead to in account takeover if user changes to a new email | 8.1 | — | 2023-01-05 | |
| CVE-2025-48877 | Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe | 8.1 | — | 2025-06-09 | |
| CVE-2023-38684 | Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actions | 7.5 | — | 2023-07-28 | |
| CVE-2026-26265 | Discourse has IDOR vulnerability in the directory items endpoint | 7.5 | — | 2026-02-26 | |
| CVE-2024-28242 | Disclosure of the existence of secret categories with custom backgrounds in Discourse | 7.5 | — | 2024-03-15 | |
| CVE-2023-45131 | Unauthenticated access to new private chat messages in Discourse | 7.5 | — | 2023-10-16 | |
| CVE-2024-35227 | Discourse vulnerable to DoS through Onebox | 7.5 | — | 2024-07-03 | |
| CVE-2024-24827 | No rate limits on POST /uploads endpoint in Discourse | 7.5 | — | 2024-03-15 | |
| CVE-2022-31184 | Email activation route can be abused by spammers in Discourse | 7.5 | — | 2022-08-01 | |
| CVE-2021-3138 | In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain for... | 7.5 | — | 2021-01-14 | |
| CVE-2023-28111 | Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses | 7.5 | — | 2023-03-17 | |
| CVE-2025-46813 | Private data leak on login-required Discourse sites | 7.5 | — | 2025-05-05 | |
| CVE-2026-26078 | Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint | 7.5 | — | 2026-02-26 | |
| CVE-2023-44388 | Malicious requests can fill up the log files resulting in a deinal of service in Discourse | 7.5 | — | 2023-10-16 | |
| CVE-2024-37299 | Discourse vulnerable to DoS via Tag Group | 7.5 | — | 2024-07-30 | |
| CVE-2023-48297 | Discourse vulnerable to unlimited mentioned users in message serializer | 7.5 | — | 2024-01-12 | |
| CVE-2023-23621 | Discourse vulnerable to ReDoS in user agent parsing | 7.5 | — | 2023-01-28 | |
| CVE-2021-41082 | Private message title and participating users leaked in discourse | 7.5 | — | 2021-09-20 | |
| CVE-2021-37693 | Re-use of email tokens in Discourse | 7.5 | — | 2021-08-13 | |
| CVE-2026-44786 | Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users | 7.5 | — | 2026-06-12 | |
| CVE-2019-1020018 | Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email l... | 7.3 | — | 2019-07-29 | |
| CVE-2022-36066 | Discourse vulnerable to RCE via admins uploading maliciously zipped file | 7.2 | — | 2022-09-29 | |
| CVE-2022-37458 | Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate. | 7.2 | — | 2022-09-02 | |
| CVE-2025-69218 | Discourse moderators can access admin-only reports exposing private upload URLs | 7.1 | — | 2026-01-28 | |
| CVE-2026-27021 | Discourse: Poll voters endpoint lacked post visibility checks | 6.9 | — | 2026-02-26 | |
| CVE-2026-23743 | Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized users | 6.9 | — | 2026-01-28 | |
| CVE-2021-43850 | Denial of Service in discourse | 6.8 | — | 2022-01-04 | |
| CVE-2026-45775 | Discourse: Cross-site backup access via path traversal in multisite local backups | 6.8 | — | 2026-06-12 | |
| CVE-2026-44784 | Discourse: Non-staff group owners can see email password in plaintext through group history | 6.5 | — | 2026-06-12 | |
| CVE-2023-22740 | Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts | 6.5 | — | 2023-01-27 | |
| CVE-2025-68934 | Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint | 6.5 | — | 2026-01-28 | |
| CVE-2024-27085 | Denial of service through invites in Discourse | 6.5 | — | 2024-03-15 | |
| CVE-2026-24742 | Discourse staff action logs expose sensitive information to moderators | 6.5 | — | 2026-01-28 | |
| CVE-2024-53851 | Partial denial of service via inline oneboxes in Discourse | 6.5 | — | 2025-02-04 | |
| CVE-2023-41042 | Discourse DoS via remote theme assets | 6.5 | — | 2023-09-15 | |
| CVE-2026-21865 | Discourse topic conversion permission vulnerability for moderators | 6.5 | — | 2026-01-28 | |
| CVE-2023-40588 | Discourse DoS via 2FA and Security Key Names | 6.5 | — | 2023-09-15 | |
| CVE-2023-22739 | Discourse subject to Allocation of Resources Without Limits or Throttling | 6.5 | — | 2023-01-26 | |
| CVE-2023-38706 | Discourse vulnerable to DoS via drafts | 6.5 | — | 2023-09-15 | |
| CVE-2023-38498 | Discourse vulnerable to DoS via defer queue | 6.5 | — | 2023-07-28 | |
| CVE-2023-41043 | Discourse DoS via SvgSprite cache | 6.5 | — | 2023-09-15 | |
| CVE-2022-39385 | Users erroneously and transparently added to private messages in Discourse | 6.5 | — | 2022-11-14 | |
| CVE-2024-27100 | Denial of service via Staff Actions in Discourse | 6.5 | — | 2024-03-15 | |
| CVE-2022-23549 | Discourse vulnerable to bypass of post max_length using HTML comments | 6.5 | — | 2023-01-05 | |
| CVE-2022-23548 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version... | 6.5 | — | 2023-01-05 | |
| CVE-2026-26077 | Discourse doesn't ensure webhooks require a token | 6.5 | — | 2026-02-26 | |
| CVE-2022-23641 | Denial of Service in Discourse | 6.5 | — | 2022-02-15 | |
| CVE-2024-36113 | Discourse missing authorization checks for suspending admins/moderators | 6.5 | — | 2024-07-03 | |
| CVE-2025-64528 | Users are able to find users by name even when `enable_names` is off | 6.3 | — | 2025-12-30 | |
| CVE-2025-49845 | Discourse users are able to see their own whispers even after being removed from a group that has been configu... | 6.3 | — | 2025-06-25 | |
| CVE-2025-61598 | Discourse is missing Cache-Control response header on error responses | 6.3 | — | 2025-10-28 | |
| CVE-2025-66488 | Discourse allows script execution in uploaded HTML/XML files on S3 | 6.1 | — | 2026-01-28 | |
| CVE-2024-56328 | HTMLi(XSS without CSP) via Onebox urls in Discourse | 6.1 | — | 2025-02-04 | |
| CVE-2025-22602 | Stored DOM-based XSS (without CSP) via video placeholders in Discourse | 6.1 | — | 2025-02-04 | |
| CVE-2023-22455 | Discourse vulnerable to Cross-site Scripting through tag descriptions | 6.1 | — | 2023-01-05 | |
| CVE-2021-37633 | XSS via d-popover and d-html-popover attribute | 6.1 | — | 2021-08-09 | |
| CVE-2021-41095 | XSS via blocked watched word in error message | 6.1 | — | 2021-09-27 | |
| CVE-2023-47119 | HTML injection in oneboxed links | 6.1 | — | 2023-11-10 | |
| CVE-2024-23834 | Discourse improperly sanitized user input leads to XSS | 6.1 | — | 2024-01-30 | |
| CVE-2024-47772 | Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse | 6.1 | — | 2024-10-07 | |
| CVE-2023-22454 | Discourse vulnerable to Cross-site Scripting through pending post titles descriptions | 6.1 | — | 2023-01-05 | |
| CVE-2025-48062 | Discourse vulnerable to HTML injection when inviting to topic via email | 6.1 | — | 2025-06-09 | |
| CVE-2024-39320 | Discourse allows iframe injection though default site setting | 6.1 | — | 2024-07-30 | |
| CVE-2025-48954 | Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow | 6.1 | — | 2025-06-25 | |
| CVE-2024-52794 | Magnific lightbox susceptible to Cross-site Scripting in Discourse | 6.1 | — | 2024-12-19 | |
| CVE-2024-35234 | Discourse vulnerable to stored-dom XSS via Facebook Oneboxes | 6.1 | — | 2024-07-03 | |
| CVE-2023-36473 | CSP nonce reuse vulnerability in Discourse | 6.1 | — | 2023-07-13 | |
| CVE-2024-37165 | Discourse has an XSS via Onebox system | 6.1 | — | 2024-07-30 | |
| CVE-2023-29196 | HTML injection via topic embedding in Discourse | 6.1 | — | 2023-04-18 | |
| CVE-2024-53991 | Potential Backup file leaked via Nginx in Discourse | 5.9 | — | 2024-12-19 | |
| CVE-2025-68666 | Discourse users archives leaked to users with moderation privileges | 5.9 | — | 2026-01-28 | |
| CVE-2022-31096 | Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certai... | 5.7 | — | 2022-06-27 | |
| CVE-2023-25167 | Regular expression denial of service via installing themes via git in discourse | 5.7 | — | 2023-02-08 | |
| CVE-2025-59337 | Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments | 5.5 | — | 2025-10-01 | |
| CVE-2022-23546 | Discourse vulnerable to private topic leak via email#send_digest | 5.5 | — | 2023-01-05 | |
| CVE-2026-44783 | Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts | 5.4 | — | 2026-06-12 | |
| CVE-2021-39161 | Cross-site scripting via category name in Discourse | 5.4 | — | 2021-08-26 | |
| CVE-2023-22468 | Discourse vulnerable to Cross-site Scripting in local oneboxes | 5.4 | — | 2023-01-26 | |
| CVE-2025-58054 | Discourse is vulnerable to XSS when quoting chat messages | 5.4 | — | 2025-10-01 | |
| CVE-2026-26207 | DIscourse's discourse-policy plugin lacks post access check | 5.4 | — | 2026-02-26 | |
| CVE-2023-43659 | Cross-site Scripting via email preview when CSP disabled in Discourse | 5.4 | — | 2023-10-16 | |
| CVE-2023-25172 | Discourse vulnerable to Cross-site Scripting - user name displayed on post | 5.4 | — | 2023-03-17 | |
| CVE-2023-30538 | Stored Cross-site Scripting via improper sanitization of svg files in Discourse | 5.4 | — | 2023-04-18 | |
| CVE-2021-32764 | YouTube Onebox susceptible to XSS | 5.4 | — | 2021-07-15 | |
| CVE-2023-37467 | Discourse CSP nonce reuse vulnerability for anonymous users | 5.4 | — | 2023-07-28 | |
| CVE-2023-45806 | Discourse vulnerable to DoS via Regexp Injection in Full Name | 5.4 | — | 2023-11-10 | |
| CVE-2024-53266 | Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse | 5.4 | — | 2025-02-04 | |
| CVE-2023-46130 | Bypassing height value allowed in some theme components | 5.4 | — | 2023-11-10 | |
| CVE-2026-27166 | Discourse vulnerable to HTML injection via prohibited iframe URLs | 5.4 | — | 2026-03-19 | |
| CVE-2022-46148 | Discourse allows self-XSS through malicious composer message | 5.4 | — | 2022-11-29 | |
| CVE-2025-68933 | Discourse non-admin moderators can exfiltrate private content via post ownership transfer | 5.4 | — | 2026-01-28 | |
| CVE-2025-67723 | Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin | 5.4 | — | 2026-01-28 | |
| CVE-2026-28218 | Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution | 5.3 | — | 2026-02-26 | |
| CVE-2021-41271 | Cache poisoning via maliciously-formed request in discourse | 5.3 | — | 2021-11-15 | |
| CVE-2025-68659 | Discourse has DoS vulnerability in username change endpoint | 5.3 | — | 2026-01-28 | |
| CVE-2022-21677 | Group advanced search option may leak group and group's members visibility | 5.3 | — | 2022-01-14 | |
| CVE-2022-24824 | Anonymous user cache poisoning in discourse | 5.3 | — | 2022-04-14 | |
| CVE-2022-39378 | Displaying user badges can leak topic titles to users that have no access to the topic | 5.3 | — | 2022-11-02 | |
| CVE-2023-22453 | Discourse vulnerable to exposure of user post counts per topic to unauthorized users | 5.3 | — | 2023-01-05 | |
| CVE-2023-34250 | Discourse vulnerable to exposure of number of topics recently created in private categories | 5.3 | — | 2023-06-13 | |
| CVE-2022-31025 | Invite bypasses user approval in Discourse | 5.3 | — | 2022-06-07 | |
| CVE-2019-1020017 | Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api... | 5.3 | — | 2019-07-29 | |
| CVE-2023-25819 | Discourse tags with no visibility are leaking into og:article:tag | 5.3 | — | 2023-03-04 | |
| CVE-2023-23615 | Malicious users in Discourse can create spam topics as any user due to improper access control | 5.3 | — | 2023-02-03 | |
| CVE-2022-31060 | Banner topic data is exposed on login-required Discourse sites | 5.3 | — | 2022-06-14 | |
| CVE-2023-23624 | Discourse's exclude_tags param could leak which topics had a specific hidden tag | 5.3 | — | 2023-01-28 | |
| CVE-2023-44391 | Prevent unauthorized access to summary details in Discourse | 5.3 | — | 2023-10-16 | |
| CVE-2025-68660 | Discourse AI Discover's continue conversation allows threat actor to impersonate user | 5.3 | — | 2026-01-28 | |
| CVE-2021-43794 | Anonymous user cache poisoning via development-mode header in Discourse | 5.3 | — | 2021-12-01 | |
| CVE-2026-47264 | Discourse: Don't leak restricted tag group names via tag info | 5.3 | — | 2026-06-12 | |
| CVE-2022-31182 | Cache poisoning via maliciously-formed request in Discourse | 5.3 | — | 2022-08-01 | |
| CVE-2026-45085 | Discourse: Chat misauthorization and information disclosure | 5.3 | — | 2026-06-12 | |
| CVE-2024-24748 | Disclosure of the existence of secret subcategories in Discourse | 5.3 | — | 2024-03-15 | |
| CVE-2023-23620 | Discourse restricted tag routes leak topic information | 5.3 | — | 2023-01-28 | |
| CVE-2023-32061 | Discourse Topic Creation Page Allows iFrame Tag without Restrictions | 5.3 | — | 2023-06-13 | |
| CVE-2022-24804 | Private group name exposure in discourse | 5.3 | — | 2022-04-11 | |
| CVE-2024-37157 | Discourse vulnerable to Server-Side Request Forgery via FastImage | 5.3 | — | 2024-07-03 | |
| CVE-2023-32301 | Discourse's canonical url not being used for topic embeddings | 5.3 | — | 2023-06-13 | |
| CVE-2025-68479 | Discourse subscriptions are susceptible to takeover | 5.3 | — | 2026-01-28 | |
| CVE-2023-31142 | Discourse's general category permissions could be set back to default | 5.3 | — | 2023-06-13 | |
| CVE-2025-69289 | Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff accoun... | 5.1 | — | 2026-01-28 | |
| CVE-2023-28107 | Discourse vulnerable to multisite DoS by spamming backups | 4.9 | — | 2023-03-17 | |
| CVE-2026-27149 | Discourse has SQL injection in PM tag filtering | 4.9 | — | 2026-02-26 | |
| CVE-2024-56197 | Users can see other user's tagged PMs in Discourse | 4.9 | — | 2025-02-04 | |
| CVE-2026-27162 | DIscourse doesn't prevent whispers to leak in excerpts | 4.9 | — | 2026-02-26 | |
| CVE-2023-30606 | Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse | 4.9 | — | 2023-04-18 | |
| CVE-2024-38360 | Denial of service via Watched Words in Discourse | 4.9 | — | 2024-07-15 | |
| CVE-2022-39241 | Possible Server-Side Request Forgery (SSRF) in webhooks | 4.9 | — | 2022-11-02 | |
| CVE-2025-32376 | Discourse DM limits aren’t always properly enforced | 4.8 | — | 2025-04-30 | |
| CVE-2022-24850 | Category group permissions leaked in Discourse | 4.3 | — | 2022-04-14 | |
| CVE-2025-24972 | Discourse may bypass user preference when adding users to chat groups | 4.3 | — | 2025-03-26 | |
| CVE-2026-44785 | Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts | 4.3 | — | 2026-06-12 | |
| CVE-2021-43792 | Notifications leak in Discourse | 4.3 | — | 2021-12-01 | |
| CVE-2022-39226 | Discourse user profile location and website fields were not sufficiently length-limited | 4.3 | — | 2022-09-29 | |
| CVE-2022-41944 | Discourse users can see notifications for topics they no longer have access to | 4.3 | — | 2022-11-28 | |
| CVE-2023-37906 | Discourse vulnerable to DoS via post edit reason | 4.3 | — | 2023-07-28 | |
| CVE-2025-58055 | Discourse AI Suggestions Contain Insecure Direct Object Reference | 4.3 | — | 2025-10-01 | |
| CVE-2024-43789 | Denial of service by the absence of restrictions on replies to posts in Discourse | 4.3 | — | 2024-10-07 | |
| CVE-2026-47263 | Discourse: Prevent webhook payload disclosure on event redelivery | 4.3 | — | 2026-06-12 | |
| CVE-2022-21678 | User's bio visible even if profile is restricted in Discourse | 4.3 | — | 2022-01-13 | |
| CVE-2022-46159 | Any authenticated Discourse user can create an unlisted topic | 4.3 | — | 2022-12-02 | |
| CVE-2021-32788 | Post creator of a whisper post can be revealed to non-staff users in Discourse | 4.3 | — | 2021-07-27 | |
| CVE-2023-49099 | Discourse secure uploads accessible to guests even when login is required | 4.3 | — | 2024-01-12 | |
| CVE-2022-41921 | Discourse chat messages should have a maximum character limit | 4.3 | — | 2022-11-28 | |
| CVE-2024-21655 | Insufficient control of custom field value sizes | 4.3 | — | 2024-01-12 | |
| CVE-2023-23935 | Presence of restricted personal Discourse messages may be leaked if tagged with a tag | 4.3 | — | 2023-03-16 | |
| CVE-2023-23622 | Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users | 4.3 | — | 2023-03-17 | |
| CVE-2026-26973 | Discourse doesn't scope reviewable notes to user-visible reviewables | 4.3 | — | 2026-02-26 | |
| CVE-2026-44779 | Discourse: Bot debug endpoints disclose whisper translation audit logs | 4.3 | — | 2026-06-12 | |
| CVE-2024-36122 | Discourse doesn't limit reviewable user serializer payload | 4.3 | — | 2024-07-03 | |
| CVE-2022-46150 | Discourse may allow exposure of hidden tags in the subject of notification emails | 4.3 | — | 2022-11-29 | |
| CVE-2023-36466 | Topic Title Validation Skipped When Changing Category in Discourse | 4.3 | — | 2023-07-14 | |
| CVE-2023-38685 | Discourse's restricted tag information visible to unauthenticated users | 4.3 | — | 2023-07-28 | |
| CVE-2022-21642 | Exposure of whisper participants in discourse | 4.3 | — | 2022-01-05 | |
| CVE-2023-23616 | Discourse membership requests lack character limit | 4.3 | — | 2023-01-28 | |
| CVE-2021-37703 | Information exposure in Discourse | 4.3 | — | 2021-08-13 | |
| CVE-2024-45297 | Prevent topic list filtering by hidden tags for unauthorized users in Discourse | 4.3 | — | 2024-10-07 | |
| CVE-2026-44782 | Discourse: GroupPostSerializer leaks hidden full names through reaction post association | 4.3 | — | 2026-06-12 | |
| CVE-2024-53994 | Potential bypass of chat permissions in Discourse | 4.3 | — | 2025-02-04 | |
| CVE-2022-36068 | Discourse moderators can edit themes via the API | 4.3 | — | 2022-09-29 | |
| CVE-2021-43793 | Bypass of Poll voting limits in Discourse | 4.3 | — | 2021-12-01 | |
| CVE-2026-44780 | Discourse: Category queue reviewers can read raw incoming emails from queued posts | 4.3 | — | 2026-06-12 | |
| CVE-2022-24782 | Secure category names leaked via user activity export in Discourse | 4.3 | — | 2022-03-24 | |
| CVE-2023-43814 | Exposure of poll options and votes to unauthorized users in Discourse | 3.7 | — | 2023-10-16 | |
| CVE-2022-46168 | Group SMTP user emails are exposed in CC email header | 3.5 | — | 2023-01-05 | |
| CVE-2023-45816 | Unread bookmark reminder notifications that the user cannot access can be seen | 3.3 | — | 2023-11-10 | |
| CVE-2025-24808 | Discourse has race condition when adding users to a group DM | 3.1 | — | 2025-03-26 | |
| CVE-2023-37904 | Discourse Race Condition in Accept Invite | 3.1 | — | 2023-07-28 | |
| CVE-2025-22601 | Client Side Path Traversal using activate account route in Discourse | 3.1 | — | 2025-02-04 | |
| CVE-2023-45147 | Arbitrary keys can be added to a topic's custom fields by any user in Discourse | 3.1 | — | 2023-10-16 | |
| CVE-2024-52589 | Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse | 2.7 | — | 2024-12-19 | |
| CVE-2023-28440 | Denial of service via admin theme import route in Discourse | 2.7 | — | 2023-04-18 | |
| CVE-2025-54411 | Discourse welcome banner user name XSS | 2.4 | — | 2025-08-19 | |
| CVE-2026-27153 | Discourse doesn't prevent moderators from exporting user Chat DMs | 1.3 | — | 2026-02-26 | |
| CVE-2026-27152 | DIscourse has DM communication-preference bypass when adding members | 1.3 | — | 2026-02-26 | |
| CVE-2026-27150 | Discourse doesn't ensure guardian check when creating QueryGroupBookmark | 1.3 | — | 2026-02-26 | |
| CVE-2026-28219 | Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners | 1.3 | — | 2026-02-26 | |
| CVE-2026-27154 | Discourse has XSS when editing a malicious post | 1.3 | — | 2026-02-26 | |
| CVE-2026-27151 | Discourse doesn't validate destination topic when moving posts | 1.3 | — | 2026-02-26 | |
| CVE-2026-28227 | Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_catego... | 1.2 | — | 2026-02-26 | |
| CVE-2026-26979 | Discourse: TL4 users are able to change status of restricted topics | 0.0 | — | 2026-02-26 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).