41034 matches found
CVE-2026-27936
Discourse before versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 include a restriction bypass that can disclose restricted post action counts to non-privileged users via a crafted request. The patch fixes are in 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Impact: potential confidentiality leaka...
CVE-2026-23658
creationtimestamp| type| source ---|---|--- 2026-03-19 21:34:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgxee5tm42s...
CVE-2026-26139
creationtimestamp| type| source ---|---|--- 2026-03-19 21:34:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgxdwg6nj2u...
CVE-2026-30836
creationtimestamp| type| source ---|---|--- 2026-03-19 21:23:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgwrskdiv2n...
CVE-2026-32169
creationtimestamp| type| source ---|---|--- 2026-03-19 21:22:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgwpxt2rv25 2026-03-20 07:40:16+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhhz7vuluw2g 2026-04-14 18:07:07+00:00| seen|...
CVE-2026-3547
creationtimestamp| type| source ---|---|--- 2026-03-19 21:22:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgwpqkx442v 2026-03-19 22:32:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhh2lsnd262v 2026-03-27 06:00:15+00:00| seen|...
CVE-2026-27934 Discourse leaks private topic title and post excerpt via user action API endpoint
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions...
EUVD-2026-13196
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions...
CVE-2026-27934 Discourse leaks private topic title and post excerpt via user action API endpoint
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions...
CVE-2026-27934 Discourse leaks private topic title and post excerpt via user action API endpoint
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions...
CVE-2026-27491
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the...
CVE-2026-27454
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The displaypost method called post.revertto directly without verifying whether the revision was hidde...
CVE-2026-32944
creationtimestamp| type| source ---|---|--- 2026-03-19 21:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgvj6rlf42s...
CVE-2026-32878
creationtimestamp| type| source ---|---|--- 2026-03-19 21:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgvixxn4o2k...
CVE-2026-27491 Discourse has a bypass of official warnings messages by non-staff users
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the...
EUVD-2026-13190
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the...
CVE-2026-27491 Discourse has a bypass of official warnings messages by non-staff users
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the...
EUVD-2026-13188
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The displaypost method called post.revertto directly without verifying whether the revision was hidde...
CVE-2026-27454
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The displaypost method called post.revertto directly without verifying whether the revision was hidde...
CVE-2026-27454 Discourse has check revision visibility on posts endpoint
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The displaypost method called post.revertto directly without verifying whether the revision was hidde...