Login Request a demo
DI
Product
discourse
by discourse · last CVE Oct 22, 2026
294
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Vulnerabilities294In the news0Timeline
Severity mix
Critical 8High 49Medium 217Low 20
Severity
All severities294Critical8High49Medium217Low20
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add discourse to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-24824
5.3
1%
Apr 14
Discourse is an open source platform for community discussion
Affected: before 2.8.3; 2.9.0; 2.9.0; 2.9.0
CVE-2022-24804
5.3
1%
Apr 11
Discourse is an open source platform for community discussion
Affected: before 2.8.3; 2.9.0; 2.9.0; 2.9.0
CVE-2022-21677
5.3
1%
Jan 14
Discourse is an open source discussion platform
Affected: through 2.7.12; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +5 more
CVE-2021-43794
5.3
1%
Dec 1
Discourse is an open source discussion platform
Affected: before 2.7.11
CVE-2021-41271
5.3
1%
Nov 15
Discourse is a platform for community discussion
Affected: through 2.7.9; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +2 more
CVE-2020-24327
5.3
1%
Sep 23
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function
Affected: 2.3.2; 2.6.0
CVE-2019-1020017
5.3
1%
Jul 29
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP
Affected: before 2.3.0; 2.4.0; 2.4.0
CVE-2026-91121
5.0
0%
Sep 24
Discourse: Chat upload filenames rendered as raw HTML in excerpts
Affected: < 2026.8.0; >= 2026.7.0-latest, < 2026.7.2; >= 2026.6.0-latest, < 2026.6.3; >= 2026.1.0-latest, < 2026.1.8
CVE-2026-33185
5.0
0%
Mar 31
Discourse: Group SMTP test endpoint susceptible to SSRF
Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0
CVE-2026-30889
4.9
0%
Mar 20
Discourse has Unauthorized Post Data Exposure in discourse-user-notes
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest.1
CVE-2026-27162
4.9
0%
Feb 26
DIscourse doesn't prevent whispers to leak in excerpts
Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0
CVE-2024-56197
4.9
0%
Feb 4
Discourse is an open source platform for community discussion
Affected: before 3.3.4; before 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0
CVE-2024-38360
4.9
0%
Jul 15
Discourse is an open source platform for community discussion
Affected: before 3.3.0; before 3.3.2; 3.3.0; 3.3.0
CVE-2023-30606
4.9
0%
Apr 18
Discourse is an open source platform for community discussion
Affected: through 3.0.1; before 3.1.0; 3.1.0; 3.1.0
CVE-2023-28107
4.9
1%
Mar 17
Discourse is an open-source discussion platform
Affected: through 3.0.1; before 3.1.0; 3.1.0; 3.1.0
CVE-2022-39241
4.9
1%
Nov 2
Possible Server-Side Request Forgery (SSRF) in webhooks
Affected: <= 2.8.9; <= 2.9.0.beta10
CVE-2026-72727
4.8
0%
Aug 10
Discourse: Stored XSS in the moderation review queue
Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1
CVE-2026-91132
4.3
0%
Sep 24
Discourse: Wildcard iframe origin allowlist bypass via authority separators
Affected: < 2026.8.0; >= 2026.7.0-latest, < 2026.7.2; >= 2026.6.0-latest, < 2026.6.3; >= 2026.1.0-latest, < 2026.1.8
CVE-2026-55704
4.3
0%
Aug 17
Discourse: Shared-draft titles and excerpts leak through group post serialization
Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1
CVE-2026-59829
4.3
0%
Aug 17
Discourse: Review queue exposes flag-related private message excerpts to category group moderators
Affected: >= 2026.1.0-latest, < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; < 2026.6.1
CVE-2026-72732
4.3
0%
Aug 10
Discourse: Templates endpoint exposes hidden tag names
Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1; >= 2026.7.0-latest, < 2026.7.0
CVE-2026-72724
4.3
1%
Aug 10
Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1; >= 2026.7.0-latest, < 2026.7.0
CVE-2026-72722
4.3
0%
Aug 10
Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1; >= 2026.7.0-latest, < 2026.7.0
CVE-2026-45780
4.3
0%
Jul 9
Discourse: Private event sample invitees are serialized to non-invited event viewers
Affected: >= 2026.1.0-latest, < 2026.1.5; >= 2026.4.0-latest, < 2026.4.2; >= 2026.5.0-latest, < 2026.5.1
CVE-2026-47263
4.3
0%
Jun 12
Discourse: Prevent webhook payload disclosure on event redelivery
Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1
CVE-2026-44785
4.3
0%
Jun 12
Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts
Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1
CVE-2026-44782
4.3
0%
Jun 12
Discourse: GroupPostSerializer leaks hidden full names through reaction post association
Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1
CVE-2026-44780
4.3
0%
Jun 12
Discourse: Category queue reviewers can read raw incoming emails from queued posts
Affected: >= 2026.4.0-latest, < 2026.4.1; >= 2026.3.0-latest, < 2026.3.1; >= 2026.1.0-latest, < 2026.1.4
CVE-2026-44779
4.3
0%
Jun 12
Discourse: Bot debug endpoints disclose whisper translation audit logs
Affected: >= 2026.1.0-latest, < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1
CVE-2026-33514
4.3
0%
May 19
Discourse: Information Disclosure in Form Template API Due to Missing Authorization
Affected: < 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1; >= 2026.5.0-latest , < 2026.5.0-latest.1
CVE-2026-32951
4.3
0%
Mar 31
Discourse: Authorization bypass in oneboxer via user-controlled category id
Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0
CVE-2026-32620
4.3
0%
Mar 31
Discourse: Missing post-level authorization allows whisper metadata disclosure
Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0
CVE-2026-32619
4.3
0%
Mar 31
Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories
Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0
CVE-2026-32618
4.3
0%
Mar 31
Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id
Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0
CVE-2026-33424
4.3
0%
Mar 20
PM access granted through invites after access revocation
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-33423
4.3
0%
Mar 20
Discourse staff can modify any user's group notification level
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-33422
4.3
0%
Mar 20
Discourse exposes ip_address of flagged user
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-32114
4.3
0%
Mar 20
Discourse's unscoped status lookups leak restricted metadata
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-31869
4.3
0%
Mar 20
Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-33393
4.3
0%
Mar 19
Discourse fixes loose hostname matching in spam host allowlist
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-27491
4.3
0%
Mar 19
Discourse has a bypass of official warnings messages by non-staff users
Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest
CVE-2026-28219
4.3
0%
Feb 26
Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners
Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0
CVE-2026-26973
4.3
0%
Feb 26
Discourse doesn't scope reviewable notes to user-visible reviewables
Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0
CVE-2025-58055
4.3
0%
Oct 1
Discourse AI Suggestions Contain Insecure Direct Object Reference
Affected: < 3.5.1
CVE-2025-32376
4.3
0%
Apr 30
Discourse DM limits aren’t always properly enforced
Affected: < 3.4.3; >= 3.5.0.beta1, < 3.5.0.beta3
CVE-2025-24972
4.3
0%
Mar 26
Discourse is an open-source discussion platform
Affected: before 3.3.4; before 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0
CVE-2024-53994
4.3
0%
Feb 4
Discourse is an open source platform for community discussion
Affected: before 3.3.3; before 3.4.0; 3.4.0; 3.4.0; 3.4.0
CVE-2024-45297
4.3
0%
Oct 7
Discourse is an open source platform for community discussion
Affected: before 3.3.2; before 3.4.0; 3.4.0
CVE-2024-43789
4.3
0%
Oct 7
Discourse is an open source platform for community discussion
Affected: before 3.3.1; through 3.4.0
CVE-2024-36122
4.3
0%
Jul 3
Discourse is an open-source discussion platform
Affected: before 3.2.3; before 3.3.0; 3.3.0; 3.3.0; 3.3.0
Page 5 of 6 · 294 total
1…456