Vulnerabilities > Discourse > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-10-19 | CVE-2021-41140 | Information Exposure vulnerability in Discourse Reactions 0.1 Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. | 5.3 |
| 2021-09-27 | CVE-2021-41095 | Cross-site Scripting vulnerability in Discourse Discourse is an open source discussion platform. | 6.1 |
| 2021-09-23 | CVE-2020-24327 | Server-Side Request Forgery (SSRF) vulnerability in Discourse 2.3.2/2.6.0 Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. | 5.3 |
| 2021-08-26 | CVE-2021-39161 | Cross-site Scripting vulnerability in Discourse Discourse is an open source platform for community discussion. | 5.4 |
| 2021-08-13 | CVE-2021-37703 | Information Exposure vulnerability in Discourse Discourse is an open-source platform for community discussion. | 4.3 |
| 2021-08-09 | CVE-2021-37633 | Cross-site Scripting vulnerability in Discourse Discourse is an open source discussion platform. | 6.1 |
| 2021-07-27 | CVE-2021-32788 | Exposure of Resource to Wrong Sphere vulnerability in Discourse Discourse is an open source discussion platform. | 4.3 |
| 2021-07-15 | CVE-2021-32764 | Cross-site Scripting vulnerability in Discourse Discourse is an open-source discussion platform. | 5.4 |
| 2019-08-26 | CVE-2019-15515 | Cross-Site Request Forgery (CSRF) vulnerability in Discourse 2.3.2 Discourse 2.3.2 sends the CSRF token in the query string. | 6.5 |
| 2019-07-29 | CVE-2019-1020017 | Unspecified vulnerability in Discourse Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP. | 5.3 |