Discourse
Page 4 of 4 — Discourse CVEs from a corpus of 309, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37703 | Medium | 4.3 | 2021-08-13 | Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the… |
CVE-2021-37693 | Medium | 5.3 | 2021-08-13 | Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an… |
CVE-2021-37633 | High | 7.4 | 2021-08-09 | Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerabili… |
CVE-2021-32788 | Medium | 4.3 | 2021-07-27 | Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed t… |
CVE-2021-32764 | High | 8.1 | 2021-07-15 | Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS att… |
CVE-2021-3138 | High | 7.5 | 2021-01-14 | In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. |
CVE-2019-15515 | Medium | 6.5 | 2019-08-26 | Discourse 2.3.2 sends the CSRF token in the query string. |
CVE-2019-1020018 | High | 7.3 | 2019-07-29 | Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link. |
CVE-2019-1020017 | Medium | 5.3 | 2019-07-29 | Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP. |