CVE-2025-68934 Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json that cause On^2 processing in Base62.decode, tying up workers for 35-60 seconds per request. This affects all users as t...

PT-2026-5195

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0 Description Discourse is an open source discussion platform. A privilege escalation issue exists...

EUVD-2023-26615

Malicious code in bioql PyPI...

EUVD-2021-28236

Malicious code in bioql PyPI...

PT-2025-40288

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.1 Description Discourse, an open-source community discussion platform, is affected by a cross-site scripting XSS issue. The issue stems from how the platform parses and renders chat channel titles and chat threa...

Discourse 授权问题漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email, and chat rooms. An authorization issue vulnerability exists in Discourse versions prior to 3.4.7 and prior to 3.5.0.beta.8, which stems from an uncleare...

CVE-2025-48062

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML...

PT-2024-13578 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.4 Discourse version beta 3.2.0.beta5 and earlier Description: Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here, which can lead...

CVE-2023-28112 Discourse's SSRF protection missing for some FastImage requests

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...

PT-2023-19078 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 on the stable branch Discourse versions prior to 3.1.0.beta2 on the beta and tests-passed branches Description: The issue concerns the submission of membership requests, where there is no character limit for...

PT-2022-27776 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.8.13 and prior Discourse versions 2.9.0.beta14 and prior Description: Discourse is an open-source discussion platform where any authenticated user can create an unlisted topic, potentially taking up unnecessary site...

PT-2022-24939 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: The issue affects Discourse, a platform for community discussion. Under certain conditions, a user badge may be awarded based on a user's activity in a...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email, and chat rooms. A security vulnerability exists in Discourse versions prior to 2.8.9, 2.9.0.beta9, and 2.9.0.beta9, which stems from a JavaScript error generated by an incomplete...

PT-2022-24011 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.8 Description: The issue allows administrators to send invitations to arbitrary email addresses at an unlimited rate. Recommendations: For versions prior to 2.8.8, update to version 2.8.8 or later to resolve th...