Login Request a demo
DI
Product
discourse
by discourse · last CVE Oct 22, 2026
294
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Vulnerabilities294In the news0Timeline
Severity mix
Critical 8High 49Medium 217Low 20
Severity
All severities294Critical8High49Medium217Low20
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add discourse to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-3138
7.5
3%
Jan 14
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms
Affected: through 2.6.0; 2.7.0
CVE-2019-1020018
7.3
1%
Jul 29
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link
Affected: before 2.3.0; 2.4.0; 2.4.0
CVE-2026-91123
7.2
0%
Sep 24
Discourse: Reject literal backslash path separators in iframe src traversal guard
Affected: < 2026.8.0; >= 2026.7.0-latest, < 2026.7.2; >= 2026.6.0-latest, < 2026.6.3; >= 2026.1.0-latest, < 2026.1.8
CVE-2022-36066
7.2
2%
Sep 29
Discourse vulnerable to RCE via admins uploading maliciously zipped file
Affected: < 2.8.9; >= 2.9.0.beta0, < 2.9.0.beta10
CVE-2022-37458
7.2
1%
Sep 2
Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate
Affected: through 2.8.7
CVE-2026-72731
7.1
0%
Aug 10
Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer
Affected: < 2026.1.7; >= 2026.6.0-latest, < 2026.6.2; >= 2026.7.0-latest, < 2026.7.1; >= 2026.8.0-latest, < 2026.8.0-latest.1
CVE-2026-44787
7.1
1%
Jul 9
Discourse: Signup-time primary_group_id assignment grants whisperer access
Affected: >= 2026.1.0-latest, < 2026.1.5; >= 2026.4.0-latest, < 2026.4.2; >= 2026.5.0-latest, < 2026.5.1
CVE-2026-45775
6.8
0%
Jun 12
Discourse: Cross-site backup access via path traversal in multisite local backups
Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1
CVE-2025-59337
6.8
0%
Oct 1
Discourse is an open-source community discussion platform
Affected: before 3.5.1; before 3.6.0; 3.6.0
CVE-2021-43850
6.8
1%
Jan 4
Discourse is an open source platform for community discussion
Affected: before 2.7.12; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +4 more
CVE-2026-91133
6.5
0%
Sep 24
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Affected: < 2026.8.0; >= 2026.7.0-latest, < 2026.7.2; >= 2026.6.0-latest, < 2026.6.3; >= 2026.1.0-latest, < 2026.1.8
CVE-2026-72726
6.5
0%
Aug 10
Discourse: Unauthorized eavesdropping on private AI bot conversations.
Affected: < 2026.1.6; >= 2026.5.0, < 2026.5.2; >= 2026.6.0, < 2026.6.1
CVE-2026-46413
6.5
1%
Jul 9
Discourse: Regular users can route multipart uploads into the admin backup store
Affected: >= 2026.1.0-latest, < 2026.1.5; >= 2026.4.0-latest, < 2026.4.2; >= 2026.5.0-latest, < 2026.5.1
CVE-2026-53961
6.5
0%
Jul 9
Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)
Affected: >= 2026.5.0-latest, < 2026.5.1; >= 2026.4.0-latest, < 2026.4.2; >= 2026.1.0-latest, < 2026.1.5
CVE-2026-44784
6.5
0%
Jun 12
Discourse: Non-staff group owners can see email password in plaintext through group history
Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1
CVE-2026-33300
6.5
0%
Mar 31
Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint
Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0
CVE-2026-32143
6.5
0%
Mar 31
Discourse: Admin-only report can be exported by moderators
Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0
CVE-2026-33428
6.5
0%
Mar 20
Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership
Affected: = 2026.3.0-latest; >= 2026.2.0-latest, < 2026.2.1; >= 2026.1.0-latest, < 2026.1.2
CVE-2026-30891
6.5
0%
Mar 20
Discourse hasUnauthorized Exposure of Private User Action Types
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest.1
CVE-2026-33355
6.5
0%
Mar 19
Discourse filters whisper posts from private-posts feed
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-32099
6.5
0%
Mar 19
Discourse prevents hidden profile data leak via user onebox
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-28282
6.5
0%
Mar 19
Discourse vulnerable to group membership addition permission bypass via discourse-policy plugin
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-27935
6.5
0%
Mar 19
Discourse leaks private topic metadata to non-authorized users
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-27149
6.5
0%
Feb 26
Discourse has SQL injection in PM tag filtering
Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0
CVE-2026-26077
6.5
1%
Feb 26
Discourse doesn't ensure webhooks require a token
Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0
CVE-2026-24742
6.5
0%
Jan 28
Discourse staff action logs expose sensitive information to moderators
Affected: < 3.5.4; >= 2025.11.0-latest, < 2025.11.2; >= 2025.12.0-latest, < 2025.12.1; >= 2026.1.0-latest, < 2026.1.0
CVE-2026-21865
6.5
0%
Jan 28
Discourse topic conversion permission vulnerability for moderators
Affected: < 3.5.4; >= 2025.11.0-latest, < 2025.11.2; >= 2025.12.0-latest, < 2025.12.1; >= 2026.1.0-latest, < 2026.1.0
CVE-2025-69218
6.5
0%
Jan 28
Discourse moderators can access admin-only reports exposing private upload URLs
Affected: < 3.5.4; >= 2025.11.0-latest, < 2025.11.2; >= 2025.12.0-latest, < 2025.12.1; >= 2026.1.0-latest, < 2026.1.0
CVE-2025-68934
6.5
0%
Jan 28
Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint
Affected: < 3.5.4; >= 2025.11.0-latest, < 2025.11.2; >= 2025.12.0-latest, 2025.12.1; >= 2026.1.0-latest, < 2026.1.0
CVE-2025-68666
6.5
0%
Jan 28
Discourse users archives leaked to users with moderation privileges
Affected: < 3.5.4; >= 2025.11.0-latest, < 2025.11.2; >= 2025.12.0-latest, < 2025.12.1; >= 2026.1.0-latest, < 2026.1.0
CVE-2024-53851
6.5
0%
Feb 4
Discourse is an open source platform for community discussion
Affected: before 3.3.3; before 3.4.0; 3.4.0; 3.4.0; 3.4.0
CVE-2024-36113
6.5
0%
Jul 3
Discourse is an open-source discussion platform
Affected: before 3.2.3; before 3.3.0; 3.3.0; 3.3.0
CVE-2024-27100
6.5
1%
Mar 15
Discourse is an open source platform for community discussion
Affected: before 3.2.1; before 3.3.0
CVE-2024-27085
6.5
1%
Mar 15
Discourse is an open source platform for community discussion
Affected: before 3.2.0; before 3.3.0; 3.3.0
CVE-2023-41043
6.5
1%
Sep 15
Discourse is an open-source discussion platform
Affected: before 3.1.1; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more
CVE-2023-41042
6.5
1%
Sep 15
Discourse is an open-source discussion platform
Affected: before 3.1.1; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more
CVE-2023-40588
6.5
1%
Sep 15
Discourse is an open-source discussion platform
Affected: before 3.1.1; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more
CVE-2023-38706
6.5
1%
Sep 15
Discourse is an open-source discussion platform
Affected: before 3.1.0; through 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; +3 more
CVE-2023-38498
6.5
1%
Jul 28
Discourse is an open source discussion platform
Affected: before 3.0.6; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more
CVE-2023-22740
6.5
1%
Jan 27
Discourse is an open source platform for community discussion
Affected: through 3.0.0
CVE-2023-22739
6.5
1%
Jan 26
Discourse is an open source platform for community discussion
Affected: before 3.0.1; 3.1.0
CVE-2022-23549
6.5
1%
Jan 5
Discourse is an option source discussion platform
Affected: before 2.8.14; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +9 more
CVE-2022-23548
6.5
1%
Jan 5
Discourse is an option source discussion platform
Affected: before 2.8.14; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +9 more
CVE-2022-39385
6.5
1%
Nov 14
Discourse is the an open source discussion platform
Affected: before 2.8.10; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +4 more
CVE-2022-23641
6.5
1%
Feb 15
Discourse is an open source discussion platform
Affected: before 2.8.1
CVE-2019-15515
6.5
1%
Aug 26
Discourse 2.3.2 sends the CSRF token in the query string
Affected: 2.3.2
CVE-2026-91119
6.4
0%
Sep 24
Discourse: Encode action_code_who in mention URLs
Affected: < 2026.8.0; >= 2026.7.0-latest, < 2026.7.2; >= 2026.6.0-latest, < 2026.6.3; >= 2026.1.0-latest, < 2026.1.8
CVE-2026-72720
6.4
0%
Aug 10
Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
Affected: < 2026.1.7; >= 2026.6.0-latest, < 2026.6.2; >= 2026.7.0-latest, < 2026.7.1; >= 2026.8.0-latest, < 2026.8.0-latest.1
CVE-2026-72728
6.3
0%
Aug 10
Discourse: Onebox iframe origin allowlist enforces URL authority boundary
Affected: < 2026.1.7; >= 2026.6.0-latest, < 2026.6.2; >= 2026.7.0-latest, < 2026.7.1; >= 2026.8.0-latest, < 2026.8.0-latest.1
CVE-2017-20290
New
6.1
0%
Oct 22
Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
Affected: 1.9.0.beta2 before 1.9.0.beta13
Page 2 of 6 · 294 total
123…6