DI
Product
discourse
294
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 8High 49Medium 217Low 20
Watch
Add discourse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-21655 | 4.3 | Jan 12 | Discourse is a platform for community discussion Affected: before 3.1.4; 3.2.0; 3.2.0; 3.2.0 |
| CVE-2023-49099 | 4.3 | Jan 12 | Discourse is a platform for community discussion Affected: before 3.1.4; 3.2.0; 3.2.0; 3.2.0 |
| CVE-2023-38685 | 4.3 | Jul 28 | Discourse is an open source discussion platform Affected: before 3.0.6; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-37906 | 4.3 | Jul 28 | Discourse is an open source discussion platform Affected: before 3.0.6; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-36466 | 4.3 | Jul 14 | Discourse is an open source discussion platform Affected: before 3.0.5; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-23622 | 4.3 | Mar 17 | Discourse is an open-source discussion platform Affected: before 3.0.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-23935 | 4.3 | Mar 16 | Discourse is an open-source messaging platform Affected: before 3.0.1; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2023-23616 | 4.3 | Jan 28 | Discourse is an open-source discussion platform Affected: before 3.0.1; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2022-46159 | 4.3 | Dec 2 | Discourse is an open-source discussion platform Affected: through 2.8.13; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +8 more |
| CVE-2022-46150 | 4.3 | Nov 29 | Discourse is an open-source discussion platform Affected: before 2.8.13; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +7 more |
| CVE-2022-41944 | 4.3 | Nov 28 | Discourse is an open-source discussion platform Affected: through 2.8.11; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +7 more |
| CVE-2022-41921 | 4.3 | Nov 28 | Discourse is an open-source discussion platform Affected: before 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +7 more |
| CVE-2022-39232 | 4.3 | Sep 29 | Discourse vulnerable to incomplete quote causing a topic to crash in the browser Affected: >= 2.9.0.beta5, < 2.9.0.beta10 |
| CVE-2022-39226 | 4.3 | Sep 29 | Discourse user profile location and website fields were not sufficiently length-limited Affected: < 2.8.9; >= 2.9.0.beta0, < 2.9.0.beta10 |
| CVE-2022-36068 | 4.3 | Sep 29 | Discourse moderators can edit themes via the API Affected: < 2.8.9; >= 2.9.0.beta0, < 2.9.0.beta10 |
| CVE-2022-24850 | 4.3 | Apr 14 | Discourse is an open source platform for community discussion Affected: before 2.8.2; 2.9.0; 2.9.0; 2.9.0 |
| CVE-2022-24782 | 4.3 | Mar 24 | Discourse is an open source discussion platform Affected: through 2.8.2 |
| CVE-2022-21678 | 4.3 | Jan 13 | Discourse is an open source discussion platform Affected: before 2.7.13; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +5 more |
| CVE-2022-21642 | 4.3 | Jan 5 | Discourse is an open source platform for community discussion Affected: before 2.7.13; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +5 more |
| CVE-2021-43793 | 4.3 | Dec 1 | Discourse is an open source discussion platform Affected: before 2.7.11; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +2 more |
| CVE-2021-43792 | 4.3 | Dec 1 | Discourse is an open source discussion platform Affected: before 2.7.11; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +2 more |
| CVE-2021-37703 | 4.3 | Aug 13 | Discourse is an open-source platform for community discussion Affected: before 2.7.8; 2.8.0; 2.8.0; 2.8.0; 2.8.0 |
| CVE-2021-32788 | 4.3 | Jul 27 | Discourse is an open source discussion platform Affected: before 2.7.7 |
| CVE-2026-84302 | 4.2 | Sep 24 | Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables Affected: < 2026.7.0; >= 2026.6.0-latest, < 2026.6.1; >= 2026.5.0-latest, < 2026.5.2; >= 2026.1.0-latest, < 2026.1.6 |
| CVE-2026-33426 | 3.8 | Mar 20 | Discourse users can edit or synonymize hidden tags they can't see Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-27152 | 3.8 | Feb 26 | DIscourse has DM communication-preference bypass when adding members Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2026-27150 | 3.8 | Feb 26 | Discourse doesn't ensure guardian check when creating QueryGroupBookmark Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2023-43814 | 3.7 | Oct 16 | Discourse is an open source platform for community discussion Affected: through 3.1.1; 3.2.0 |
| CVE-2022-46168 | 3.5 | Jan 5 | Discourse is an option source discussion platform Affected: before 2.8.14; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +9 more |
| CVE-2023-45816 | 3.3 | Nov 10 | Discourse is an open source platform for community discussion Affected: before 3.1.3; before 3.2.0; 3.2.0; 3.2.0 |
| CVE-2025-24808 | 3.1 | Mar 26 | Discourse is an open-source discussion platform Affected: before 3.3.3; before 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0 |
| CVE-2025-22601 | 3.1 | Feb 4 | Discourse is an open source platform for community discussion Affected: before 3.4.0; 3.4.0; 3.4.0; 3.4.0 |
| CVE-2023-45147 | 3.1 | Oct 16 | Discourse is an open source community platform Affected: through 3.1.1; 3.2.0 |
| CVE-2023-37904 | 3.1 | Jul 28 | Discourse is an open source discussion platform Affected: before 3.0.6; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2026-33415 | 2.7 | Mar 31 | Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure Affected: >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0 |
| CVE-2026-33408 | 2.7 | Mar 19 | Discourse has Improper Authorization in "Post Edits" Report For Moderators Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-33394 | 2.7 | Mar 19 | Discourse leaks PM post edits to moderators Affected: >= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest |
| CVE-2026-28227 | 2.7 | Feb 26 | Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2026-27153 | 2.7 | Feb 26 | Discourse doesn't prevent moderators from exporting user Chat DMs Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2026-27151 | 2.7 | Feb 26 | Discourse doesn't validate destination topic when moving posts Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2026-26979 | 2.7 | Feb 26 | Discourse: TL4 users are able to change status of restricted topics Affected: < 2025.12.2; >= 2026.1.0-latest, < 2026.1.1; >= 2026.2.0-latest, < 2026.2.0 |
| CVE-2024-52589 | 2.7 | Dec 19 | Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse Affected: stable: <= 3.3.2; beta: <= 3.4.0.beta2; tests-passed: <= 3.4.0.beta2 |
| CVE-2023-28440 | 2.7 | Apr 18 | Discourse is an open source platform for community discussion Affected: before 3.0.3; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2026-72729 | 2.0 | Aug 10 | Discourse: Stored XSS in discourse-local-dates plugin Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1 |