DI
Product
discourse
294
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 8High 49Medium 217Low 20
Watch
Add discourse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-37467 | 5.4 | Jul 28 | Discourse is an open source discussion platform Affected: 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-30538 | 5.4 | Apr 18 | Discourse is an open source platform for community discussion Affected: through 3.0.2; before 3.1.0; 3.1.0; 3.1.0; 3.1.0 |
| CVE-2023-25172 | 5.4 | Mar 17 | Discourse is an open-source discussion platform Affected: before 3.0.1; before 3.1.0; 3.1.0 |
| CVE-2023-22468 | 5.4 | Jan 26 | Discourse is an open source platform for community discussion Affected: before 2.8.13; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +10 more |
| CVE-2022-46148 | 5.4 | Nov 29 | Discourse is an open-source messaging platform Affected: through 2.8.10; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +5 more |
| CVE-2021-39161 | 5.4 | Aug 26 | Discourse is an open source platform for community discussion Affected: before 2.7.8; 2.8.0; 2.8.0; 2.8.0; 2.8.0 |
| CVE-2021-32764 | 5.4 | Jul 15 | Discourse is an open-source discussion platform Affected: through 2.7.5; 2.8.0 |
| CVE-2026-53960 | 5.3 | Aug 17 | Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1 |
| CVE-2026-72723 | 5.3 | Aug 10 | Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1; >= 2026.7.0-latest, < 2026.7.0 |
| CVE-2026-72721 | 5.3 | Aug 10 | Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1; >= 2026.7.0-latest, < 2026.7.0 |
| CVE-2026-59828 | 5.3 | Jul 9 | Discourse: Hidden post revisions leak through adjacent visible diffs Affected: >= 2026.1.0-latest, < 2026.1.5; >= 2026.4.0-latest, < 2026.4.2; >= 2026.5.0-latest, < 2026.5.1 |
| CVE-2026-47264 | 5.3 | Jun 12 | Discourse: Don't leak restricted tag group names via tag info Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1 |
| CVE-2026-45085 | 5.3 | Jun 12 | Discourse: Chat misauthorization and information disclosure Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1 |
| CVE-2026-34154 | 5.3 | May 19 | Discourse has a subscription access bypass in its discourse-subscriptions plugin Affected: < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1; >= 2026.5.0-latest, < 2026.5.0-latest.1 |
| CVE-2026-32244 | 5.3 | May 19 | Discourse: Cached outdated summaries can leak removed content Affected: < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1; >= 2026.5.0-latest, < 2026.5.0-latest.1 |
| CVE-2026-34947 | 5.3 | Apr 3 | Discourse: Staged user custom fields are exposed on public invite pages Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0 |
| CVE-2026-27481 | 5.3 | Apr 3 | Discourse: Hidden tag visibility bypass on tag routes Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0 |
| CVE-2026-33074 | 5.3 | Mar 31 | Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0 |
| CVE-2026-33073 | 5.3 | Mar 31 | discourse-subscriptions plugin leaking stripe API key in multisite environment Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0 |
| CVE-2026-33425 | 5.3 | Mar 20 | Discourse has inferable private group membership or existence via exclude_groups parameter Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-27936 | 5.3 | Mar 19 | Discourse discloses restricted post-action counts to non-privileged users Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-27454 | 5.3 | Mar 19 | Discourse has check revision visibility on posts endpoint Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-27021 | 5.3 | Feb 26 | Discourse: Poll voters endpoint lacked post visibility checks Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2025-68659 | 5.3 | Jan 28 | Discourse has DoS vulnerability in username change endpoint Affected: < 3.5.4; >= 2025.11.0-latest, < 2025.11.2; >= 2025.12.0-latest, < 2025.12.1; >= 2026.1.0-latest, < 2026.1.0 |
| CVE-2025-68479 | 5.3 | Jan 28 | Discourse subscriptions are susceptible to takeover Affected: < 3.5.4; >= 2025.11.0-latest, < 2025.11.2; >= 2025.12.0-latest, < 2025.12.1; >= 2026.1.0-latest, < 2026.1.0 |
| CVE-2025-64528 | 5.3 | Dec 30 | Users are able to find users by name even when `enable_names` is off Affected: < 3.5.3; >= 2025.11.0-latest, < 2025.11.1; >= 2025.12.0-latest, < 2025.12.0 |
| CVE-2025-61598 | 5.3 | Oct 28 | Discourse is missing Cache-Control response header on error responses Affected: < 3.6.2; >= 3.6.0.beta1, < 3.6.0.beta2 |
| CVE-2024-37157 | 5.3 | Jul 3 | Discourse is an open-source discussion platform Affected: before 3.2.3; before 3.3.0; 3.3.0; 3.3.0; 3.3.0 |
| CVE-2024-24748 | 5.3 | Mar 15 | Discourse is an open source platform for community discussion Affected: through 3.2.0; through 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +1 more |
| CVE-2023-44391 | 5.3 | Oct 16 | Discourse is an open source platform for community discussion Affected: through 3.1.1; 3.2.0 |
| CVE-2023-34250 | 5.3 | Jun 13 | Discourse is an open source discussion platform Affected: before 3.0.4; 3.1.0; 3.1.0; 3.1.0; 3.1.0 |
| CVE-2023-32301 | 5.3 | Jun 13 | Discourse is an open source discussion platform Affected: before 3.0.4; 3.1.0; 3.1.0; 3.1.0; 3.1.0 |
| CVE-2023-32061 | 5.3 | Jun 13 | Discourse is an open source discussion platform Affected: before 3.0.4; 3.1.0; 3.1.0; 3.1.0; 3.1.0 |
| CVE-2023-31142 | 5.3 | Jun 13 | Discourse is an open source discussion platform Affected: before 3.0.4; 3.1.0; 3.1.0; 3.1.0; 3.1.0 |
| CVE-2023-25819 | 5.3 | Mar 4 | Discourse is an open source platform for community discussion Affected: before 3.1.0; 3.1.0; 3.1.0 |
| CVE-2023-23615 | 5.3 | Feb 3 | Discourse is an open source discussion platform Affected: through 3.0.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-23624 | 5.3 | Jan 28 | Discourse is an open-source discussion platform Affected: before 3.0.1; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-23620 | 5.3 | Jan 28 | Discourse is an open-source discussion platform Affected: before 3.0.1; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-22453 | 5.3 | Jan 5 | Discourse is an option source discussion platform Affected: before 2.8.14; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2022-39378 | 5.3 | Nov 2 | Displaying user badges can leak topic titles to users that have no access to the topic Affected: <= 2.8.9; <= 2.9.0.beta10 |
| CVE-2022-31182 | 5.3 | Aug 1 | Cache poisoning via maliciously-formed request in Discourse Affected: < 2.8.7; < 2.9.0.beta8 |
| CVE-2022-31060 | 5.3 | Jun 14 | Discourse is an open-source discussion platform Affected: before 2.8.4; 2.9.0; 2.9.0; 2.9.0; 2.9.0 |
| CVE-2022-31025 | 5.3 | Jun 7 | Discourse is an open source platform for community discussion Affected: before 2.8.4; 2.9.0; 2.9.0; 2.9.0; 2.9.0 |
| CVE-2022-24824 | 5.3 | Apr 14 | Discourse is an open source platform for community discussion Affected: before 2.8.3; 2.9.0; 2.9.0; 2.9.0 |
| CVE-2022-24804 | 5.3 | Apr 11 | Discourse is an open source platform for community discussion Affected: before 2.8.3; 2.9.0; 2.9.0; 2.9.0 |
| CVE-2022-21677 | 5.3 | Jan 14 | Discourse is an open source discussion platform Affected: through 2.7.12; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +5 more |
| CVE-2021-43794 | 5.3 | Dec 1 | Discourse is an open source discussion platform Affected: before 2.7.11 |
| CVE-2021-41271 | 5.3 | Nov 15 | Discourse is a platform for community discussion Affected: through 2.7.9; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +2 more |
| CVE-2020-24327 | 5.3 | Sep 23 | Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function Affected: 2.3.2; 2.6.0 |
| CVE-2019-1020017 | 5.3 | Jul 29 | Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP Affected: before 2.3.0; 2.4.0; 2.4.0 |