CVE Vulnerability Catalog

An authorization bypass in Discourse's Category Chatables controller allows moderators to get information about hidden groups and user counts.

Discourse has a vulnerability in the group email settings test endpoint that allows initiating outbound connections to arbitrary hosts and ports. The endpoint was accessible to non-staff group owners.

Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 allow a user to purchase a lower tier subscription but gain benefits associated with a higher tier subscription.

Discourse with the discourse-subscriptions plugin from versions 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 leaks Stripe API keys across sites in a multisite cluster, potentially exposing Stripe-related information across sites.

Discourse allows an authenticated user to obtain shared draft topic titles by sending an inline onebox request with a matching category_id.

Discourse allows non-staff users to access read receipt information for staff-only posts. Metadata (who read and when) is exposed, but not post content.

Discourse versions before 2026.1.3, 2026.2.2, and 2026.3.0 allow users who lost access to a topic to still interact with polls, including voting and toggling status.

Discourse allows inference of chat channel membership from user search without proper authorization.

In the Discourse discussion platform, versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 allowed category group moderators to perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

In Discourse, when the hidden 'prioritize_full_name_in_ux' setting is enabled, user and group display names are rendered without HTML escaping in several assignment-related UI paths. This allows users with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user viewing an affected topic.

In Discourse, updating a category description via API does not sanitize the description string, which can lead to XSS attacks. This affects versions from 2026.1.0 before 2026.1.3, 2026.2.0 before 2026.2.2, and 2026.3.0 before 2026.3.0.

In Discourse, an attacker with the ability to create shared AI conversations can inject arbitrary HTML and JavaScript via crafted conversation titles. The payload executes in the browser of any user viewing the onebox preview, potentially allowing session hijacking or unauthorized actions on behalf of the victim.

In Discourse, moderators can export CSV data from admin-restricted reports, bypassing visibility restrictions. This could expose sensitive operational data.

Discourse has a vulnerability in the enter action of StaticController that reads the sso_destination_url cookie and redirects to it with allow_other_host: true without validating the destination URL. Cookies are client-controlled and can be set by attackers.

SourceCodester Loan Management System v1.0 has a blind SQL injection vulnerability in ajax.php (save_loan action). The borrower_id parameter is not properly sanitized, allowing an authenticated attacker to inject malicious SQL commands.

In chatwoot up to version 4.11.2, the Webhooks::Trigger function in lib/webhooks/trigger.rb does not validate the url argument, leading to server-side request forgery (SSRF). The attack is remotely exploitable and the exploit is publicly available.

HAPI FHIR prior to version 6.9.4 has a /loadIG HTTP endpoint in the FHIR Validator HTTP service that accepts a user-supplied URL via JSON body and makes server-side HTTP requests without hostname, scheme, or domain validation. An unauthenticated attacker with network access can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage.

NVIDIA Jetson Linux has a vulnerability in initrd where the nvluks trusted application is not disabled. Exploitation of this flaw may lead to information disclosure.

A vulnerability was found in CMS Made Simple up to version 2.2.22 in the _copyFilesToFolder function of the UserGuide Module XML Import component. Manipulation leads to path traversal, enabling remote attack. The exploit is publicly available, and the project confirmed it has been fixed in the next release.

In Search Guard FLX from version 1.0.0 up to 4.0.1, a vulnerability was found where the audit logging feature might log user credentials from users logging into Kibana.