目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

discourse 厂商漏洞列表 / CVE 中文分析 290

discourse 厂商相关 290 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

Discourse 是一款基于 Ruby on Rails 的开源论坛软件，旨在提供现代化的社区讨论平台。其历史漏洞多集中于跨站脚本（XSS）、远程代码执行（RCE）及权限绕过，累计收录 265 条 CVE。项目采用严格的安全开发流程，包括自动化测试与代码审查，并定期发布安全更新以修复已知风险。尽管面临复杂的安全挑战，Discourse 仍通过持续迭代维护社区信任，是开源协作领域的重要基础设施之一。

上位製品 discourse: discourse discourse-calendar discourse-reactions discourse-chat discourse-ai discourse-policy discourse-code-review discourse-placeholder-theme-component WP Discourse discourse-microsoft-auth discourse-group-membership-ip-block discourse-jira discourse-encrypt discourse-yearly-review discourse-mermaid-theme-component discourse-bbcode discourse-patreon DiscoTOC discourse-assign message_bus discourse-footnote rails_multisite
CVE IDタイトルCVSS深刻度公開日
CVE-2026-33074 Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions — discourseCWE-269 7.1 -2026-03-31
CVE-2026-32951 Discourse: Authorization bypass in oneboxer via user-controlled category id — discourseCWE-200 4.3 Medium2026-03-31
CVE-2026-32620 Discourse: Missing post-level authorization allows whisper metadata disclosure — discourseCWE-200 4.3 -2026-03-31
CVE-2026-32619 Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories — discourseCWE-285 5.4 -2026-03-31
CVE-2026-32618 Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id — discourseCWE-200 4.3 Medium2026-03-31
CVE-2026-32615 Discourse: Category group moderators can perform actions on topics in restricted categories without read access — discourseCWE-285 7.1 -2026-03-31
CVE-2026-32607 Discourse: Stored XSS via unescaped assignee name — discourseCWE-79 5.4 -2026-03-31
CVE-2026-32273 Discourse: XSS on category description update via API — discourseCWE-79 5.4 Medium2026-03-31
CVE-2026-32243 Discourse: Stored XSS in discourse-ai shared conversations onebox — discourseCWE-79 5.4 -2026-03-31
CVE-2026-32143 Discourse: Admin-only report can be exported by moderators — discourseCWE-200 6.5 -2026-03-31
CVE-2026-32113 Discourse: Open redirect via `sso_destination_url` cookie in `enter` — discourseCWE-601 6.4 -2026-03-31
CVE-2026-33073 discourse-subscriptions plugin leaking stripe API key in multisite environment — discourseCWE-200 6.5 -2026-03-31
CVE-2026-33428 Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership — discourseCWE-863 5.4 -2026-03-20
CVE-2026-33427 Discourse Authorization Page Displays Unvalidated Redirect Domain — discourseCWE-862 4.3 -2026-03-20
CVE-2026-33426 Discourse users can edit or synonymize hidden tags they can't see — discourseCWE-862 3.5 Low2026-03-20
CVE-2026-33425 Discourse has inferable private group membership or existence via exclude_groups parameter — discourseCWE-203 5.3 -2026-03-20
CVE-2026-33424 PM access granted through invites after access revocation — discourseCWE-863 5.9 Medium2026-03-20
CVE-2026-33423 Discourse staff can modify any user's group notification level — discourseCWE-862 4.3 -2026-03-20
CVE-2026-33422 Discourse exposes ip_address of flagged user — discourseCWE-200 3.5 Low2026-03-20
CVE-2026-33411 Discourse's solved topic stream has potential stored XSS in topic title — discourseCWE-79 5.4 Medium2026-03-20
CVE-2026-33291 Discourse user can create Zendesk tickets even when it does not have access to topic — discourseCWE-863 4.3 -2026-03-20
CVE-2026-33251 Discourse has a Hidden Solved topics permission bypass — discourseCWE-863 5.4 Medium2026-03-20
CVE-2026-32114 Discourse's unscoped status lookups leak restricted metadata — discourseCWE-639 4.3 -2026-03-20
CVE-2026-31869 Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check — discourseCWE-200 4.3 -2026-03-20
CVE-2026-31805 Discourse has a poll authorization bypass via post_id array parameter — discourseCWE-863 5.3 Medium2026-03-20
CVE-2026-30891 Discourse hasUnauthorized Exposure of Private User Action Types — discourseCWE-200 6.5 -2026-03-20
CVE-2026-30889 Discourse has Unauthorized Post Data Exposure in discourse-user-notes — discourseCWE-862 4.3 -2026-03-20
CVE-2026-30888 Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint — discourseCWE-269 2.2 Low2026-03-20
CVE-2026-33408 Discourse has Improper Authorization in "Post Edits" Report For Moderators — discourseCWE-862 2.2 Low2026-03-19
CVE-2026-33395 Discourse has stored click‑based XSS via Graphviz SVG javascript: links — discourseCWE-79 4.4 Medium2026-03-19

本页汇总了 discourse 厂商截至目前公开的全部 290 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。