Исправлено в
CVE, затрагивающие 3.6
| CVE | Название | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|
| CVE-2026-26265 | Discourse has IDOR vulnerability in the directory items endpoint | 7.5 | — | 2026-02-26 | |
| CVE-2026-26078 | Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint | 7.5 | — | 2026-02-26 | |
| CVE-2021-41082 | Private message title and participating users leaked in discourse | 7.5 | — | 2021-09-20 | |
| CVE-2026-44786 | Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users | 7.5 | — | 2026-06-12 | |
| CVE-2026-27021 | Discourse: Poll voters endpoint lacked post visibility checks | 6.9 | — | 2026-02-26 | |
| CVE-2026-45775 | Discourse: Cross-site backup access via path traversal in multisite local backups | 6.8 | — | 2026-06-12 | |
| CVE-2026-44784 | Discourse: Non-staff group owners can see email password in plaintext through group history | 6.5 | — | 2026-06-12 | |
| CVE-2026-26077 | Discourse doesn't ensure webhooks require a token | 6.5 | — | 2026-02-26 | |
| CVE-2025-61598 | Discourse is missing Cache-Control response header on error responses | 6.3 | — | 2025-10-28 | |
| CVE-2025-59337 | Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments | 5.5 | — | 2025-10-01 | |
| CVE-2026-44783 | Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts | 5.4 | — | 2026-06-12 | |
| CVE-2025-58054 | Discourse is vulnerable to XSS when quoting chat messages | 5.4 | — | 2025-10-01 | |
| CVE-2026-26207 | DIscourse's discourse-policy plugin lacks post access check | 5.4 | — | 2026-02-26 | |
| CVE-2026-27166 | Discourse vulnerable to HTML injection via prohibited iframe URLs | 5.4 | — | 2026-03-19 | |
| CVE-2026-28218 | Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution | 5.3 | — | 2026-02-26 | |
| CVE-2026-47264 | Discourse: Don't leak restricted tag group names via tag info | 5.3 | — | 2026-06-12 | |
| CVE-2026-45085 | Discourse: Chat misauthorization and information disclosure | 5.3 | — | 2026-06-12 | |
| CVE-2026-27149 | Discourse has SQL injection in PM tag filtering | 4.9 | — | 2026-02-26 | |
| CVE-2026-27162 | DIscourse doesn't prevent whispers to leak in excerpts | 4.9 | — | 2026-02-26 | |
| CVE-2026-44785 | Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts | 4.3 | — | 2026-06-12 | |
| CVE-2025-58055 | Discourse AI Suggestions Contain Insecure Direct Object Reference | 4.3 | — | 2025-10-01 | |
| CVE-2026-47263 | Discourse: Prevent webhook payload disclosure on event redelivery | 4.3 | — | 2026-06-12 | |
| CVE-2026-26973 | Discourse doesn't scope reviewable notes to user-visible reviewables | 4.3 | — | 2026-02-26 | |
| CVE-2026-44779 | Discourse: Bot debug endpoints disclose whisper translation audit logs | 4.3 | — | 2026-06-12 | |
| CVE-2026-44782 | Discourse: GroupPostSerializer leaks hidden full names through reaction post association | 4.3 | — | 2026-06-12 | |
| CVE-2026-44780 | Discourse: Category queue reviewers can read raw incoming emails from queued posts | 4.3 | — | 2026-06-12 | |
| CVE-2026-27153 | Discourse doesn't prevent moderators from exporting user Chat DMs | 1.3 | — | 2026-02-26 | |
| CVE-2026-27152 | DIscourse has DM communication-preference bypass when adding members | 1.3 | — | 2026-02-26 | |
| CVE-2026-27150 | Discourse doesn't ensure guardian check when creating QueryGroupBookmark | 1.3 | — | 2026-02-26 | |
| CVE-2026-28219 | Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners | 1.3 | — | 2026-02-26 | |
| CVE-2026-27154 | Discourse has XSS when editing a malicious post | 1.3 | — | 2026-02-26 | |
| CVE-2026-27151 | Discourse doesn't validate destination topic when moving posts | 1.3 | — | 2026-02-26 | |
| CVE-2026-28227 | Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_catego... | 1.2 | — | 2026-02-26 | |
| CVE-2026-26979 | Discourse: TL4 users are able to change status of restricted topics | 0.0 | — | 2026-02-26 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).