DI
Product
discourse
294
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 8High 49Medium 217Low 20
Watch
Add discourse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-68662 | 9.9 | Jan 28 | Discourse is an open source discussion platform Affected: before 3.5.4; 2025.11.0 before 2025.11.2; 2025.12.0; 2026.1.0 |
| CVE-2025-53102 | 9.8 | Jul 29 | Discourse is an open-source community discussion platform Affected: before 3.4.6; through 3.5.0; 3.5.0; 3.5.0; 3.5.0; 3.5.0; +3 more |
| CVE-2025-48877 | 9.8 | Jun 9 | Discourse is an open-source discussion platform Affected: before 3.4.4; before 3.5.0; 3.5.0; 3.5.0; 3.5.0; 3.5.0 |
| CVE-2023-47121 | 9.8 | Nov 10 | Discourse is an open source platform for community discussion Affected: before 3.1.3; before 3.2.0; 3.2.0; 3.2.0 |
| CVE-2021-41163 | 9.8 | Oct 20 | Discourse is an open source platform for community discussion Affected: before 2.7.9; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +1 more |
| CVE-2026-55674 | 9.3 | Aug 17 | Discourse: Cache poisoning/XSS via color scheme cookies Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1 |
| CVE-2024-49765 | 9.1 | Dec 19 | Bypass of Discourse Connect using other login paths if enabled in Discourse Affected: stable: <= 3.3.2; beta: <= 3.4.0.beta3; tests-passed: <= 3.4.0.beta3 |
| CVE-2026-53963 | 9.0 | Jul 9 | Discourse: Stored-XSS in 2FA delete confirmation modal Affected: >= 2026.1.0-latest, < 2026.1.5; >= 2026.4.0-latest, < 2026.4.2; >= 2026.5.0-latest, < 2026.5.1 |
| CVE-2022-39356 | 8.8 | Nov 2 | Discourse user account takeover via email and invite link Affected: <= 2.8.9; <= 2.9.0.beta10 |
| CVE-2022-21684 | 8.8 | Jan 13 | Discourse is an open source discussion platform Affected: before 2.7.13; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +5 more |
| CVE-2026-91122 | 8.7 | Sep 24 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users Affected: < 2026.8.0; >= 2026.7.0-latest, < 2026.7.2; >= 2026.6.0-latest, < 2026.6.3; >= 2026.1.0-latest, < 2026.1.8 |
| CVE-2026-72730 | 8.7 | Aug 10 | Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1 |
| CVE-2026-31805 | 8.2 | Mar 20 | Discourse has a poll authorization bypass via post_id array parameter Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest.1 |
| CVE-2025-23023 | 8.2 | Feb 4 | Discourse is an open source platform for community discussion Affected: before 3.3.2 |
| CVE-2024-55948 | 8.2 | Feb 4 | Discourse is an open source platform for community discussion Affected: before 3.3.2 |
| CVE-2024-47773 | 8.2 | Oct 8 | Discourse is an open source platform for community discussion Affected: before 3.3.2 |
| CVE-2024-45051 | 8.2 | Oct 7 | Discourse is an open source platform for community discussion Affected: before 3.3.2; before 3.4.0; 3.4.0 |
| CVE-2026-55420 | 8.1 | Jul 9 | Discourse: Remote code execution via pdf uploads Affected: >= 2026.5.0-latest, < 2026.5.1; >= 2026.4.0-latest, < 2026.4.2; >= 2026.1.0-latest, < 2026.1.5 |
| CVE-2023-28112 | 8.1 | Mar 17 | Discourse is an open-source discussion platform Affected: before 3.1.0; through 3.1.0; 3.1.0; 3.1.0 |
| CVE-2022-46177 | 8.1 | Jan 5 | Discourse is an option source discussion platform Affected: before 2.8.14; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2026-91159 | 7.7 | Oct 14 | Discourse: Stored oEmbed HTML injection via allowed iframe Affected: < 2026.1.9; >= 2026.7.0-latest, < 2026.7.3; >= 2026.8.0-latest, < 2026.8.1; >= 2026.9.0-latest, < 2026.9.0 |
| CVE-2026-91157 | 7.5 | Oct 14 | Discourse: Media uploads remain publicly accessible after category permissions are restricted Affected: < 2026.1.9; >= 2026.7.0-latest, < 2026.7.3; >= 2026.8.0-latest, < 2026.8.1; >= 2026.9.0-latest, < 2026.9.0 |
| CVE-2026-91156 | 7.5 | Oct 14 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users Affected: < 2026.1.9; >= 2026.7.0-latest, < 2026.7.3; >= 2026.8.0-latest, < 2026.8.1; >= 2026.9.0-latest, < 2026.9.0 |
| CVE-2026-45788 | 7.5 | Jul 9 | Discourse: Secure uploads exposed by hotlinked image copying Affected: >= 2026.1.0-latest, < 2026.1.5; >= 2026.4.0-latest, < 2026.4.2; >= 2026.5.0-latest, < 2026.5.1 |
| CVE-2026-49256 | 7.5 | Jul 9 | Discourse: Hidden tag names leaked via category serializers Affected: >= 2026.1.0-latest, < 2026.1.5; >= 2026.4.0-latest, < 2026.4.2; >= 2026.5.0-latest, < 2026.5.1 |
| CVE-2026-44786 | 7.5 | Jun 12 | Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1 |
| CVE-2026-33427 | 7.5 | Mar 20 | Discourse Authorization Page Displays Unvalidated Redirect Domain Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-29072 | 7.5 | Mar 19 | Discourse missing permission check for policy creation in discourse-policy Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-27934 | 7.5 | Mar 19 | Discourse leaks private topic title and post excerpt via user action API endpoint Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-26265 | 7.5 | Feb 26 | Discourse is an open source discussion platform Affected: before 2025.12.0; 2026.1.0 before 2026.1.1; 2026.2.0 |
| CVE-2026-26078 | 7.5 | Feb 26 | Discourse is an open source discussion platform Affected: before 2025.12.0; 2026.1.0 before 2026.1.1; 2026.2.0 |
| CVE-2026-23743 | 7.5 | Jan 28 | Discourse is an open source discussion platform Affected: before 3.5.4; 2025.11.0 before 2025.11.2; 2025.12.0; 2026.1.0 |
| CVE-2025-49845 | 7.5 | Jun 25 | Discourse is an open-source discussion platform Affected: before 3.4.6 |
| CVE-2025-48053 | 7.5 | Jun 9 | Discourse is an open-source discussion platform Affected: before 3.4.4; before 3.5.0; 3.5.0; 3.5.0; 3.5.0; 3.5.0 |
| CVE-2025-46813 | 7.5 | May 5 | Discourse is an open-source community platform Affected: before 3.5.0; 3.5.0; 3.5.0; 3.5.0 |
| CVE-2024-37299 | 7.5 | Jul 30 | Discourse is an open source discussion platform Affected: before 3.2.5; 3.3.0; 3.3.0; 3.3.0; 3.3.0 |
| CVE-2024-35227 | 7.5 | Jul 3 | Discourse is an open-source discussion platform Affected: through 3.2.2 |
| CVE-2024-28242 | 7.5 | Mar 15 | Discourse is an open source platform for community discussion Affected: before 3.2.0; before 3.3.0; 3.3.0; 3.3.0 |
| CVE-2024-24827 | 7.5 | Mar 15 | Discourse is an open source platform for community discussion Affected: before 3.2.0; before 3.3.0 |
| CVE-2023-48297 | 7.5 | Jan 12 | Discourse is a platform for community discussion Affected: before 3.1.4; 3.2.0; 3.2.0; 3.2.0 |
| CVE-2023-47120 | 7.5 | Nov 10 | Discourse is an open source platform for community discussion Affected: 3.1.0 before 3.1.3; 3.1.0; 3.1.0; 3.1.0; 3.2.0; 3.2.0 |
| CVE-2023-45131 | 7.5 | Oct 16 | Discourse is an open source platform for community discussion Affected: through 3.1.1; 3.2.0 |
| CVE-2023-44388 | 7.5 | Oct 16 | Discourse is an open source platform for community discussion Affected: through 3.1.1; 3.2.0 |
| CVE-2023-38684 | 7.5 | Jul 28 | Discourse is an open source discussion platform Affected: before 3.0.6; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-36818 | 7.5 | Jul 14 | Discourse is an open source discussion platform Affected: 3.1.0 |
| CVE-2023-28111 | 7.5 | Mar 17 | Discourse is an open-source discussion platform Affected: before 3.1.0; 3.1.0; 3.1.0 |
| CVE-2023-23621 | 7.5 | Jan 28 | Discourse is an open-source discussion platform Affected: before 3.0.1; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2022-31184 | 7.5 | Aug 1 | Email activation route can be abused by spammers in Discourse Affected: < 2.8.7; < 2.9.0.beta8 |
| CVE-2021-41082 | 7.5 | Sep 20 | Discourse is a platform for community discussion Affected: before 2021-09-14 |
| CVE-2021-37693 | 7.5 | Aug 13 | Discourse is an open-source platform for community discussion Affected: before 2.7.8; 2.8.0; 2.8.0; 2.8.0 |