Login Request a demo
DI
Product
discourse
by discourse · last CVE Oct 22, 2026
294
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Vulnerabilities294In the news0Timeline
Severity mix
Critical 8High 49Medium 217Low 20
Severity
All severities294Critical8High49Medium217Low20
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add discourse to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-68662
9.9
0%
Jan 28
FinalDestination hostname matching allows SSRF protection bypass
Affected: < 3.5.4; >= 2025.11.0-latest, < 2025.11.2; >= 2025.12.0-latest, < 2025.12.1; >= 2026.1.0-latest, < 2026.1.0
CVE-2025-53102
9.8
0%
Jul 29
Discourse is an open-source community discussion platform
Affected: before 3.4.6; through 3.5.0; 3.5.0; 3.5.0; 3.5.0; 3.5.0; +3 more
CVE-2025-48877
9.8
0%
Jun 9
Discourse is an open-source discussion platform
Affected: before 3.4.4; before 3.5.0; 3.5.0; 3.5.0; 3.5.0; 3.5.0
CVE-2023-47121
9.8
1%
Nov 10
Discourse is an open source platform for community discussion
Affected: before 3.1.3; before 3.2.0; 3.2.0; 3.2.0
CVE-2021-41163
9.8
20%
Oct 20
Discourse is an open source platform for community discussion
Affected: before 2.7.9; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +1 more
CVE-2026-55674
9.3
1%
Aug 17
Discourse: Cache poisoning/XSS via color scheme cookies
Affected: < 2026.1.6; >= 2026.5.0-latest, < 2026.5.2; >= 2026.6.0-latest, < 2026.6.1
CVE-2024-49765
9.1
0%
Dec 19
Bypass of Discourse Connect using other login paths if enabled in Discourse
Affected: stable: <= 3.3.2; beta: <= 3.4.0.beta3; tests-passed: <= 3.4.0.beta3
CVE-2026-53963
9.0
1%
Jul 9
Discourse: Stored-XSS in 2FA delete confirmation modal
Affected: >= 2026.1.0-latest, < 2026.1.5; >= 2026.4.0-latest, < 2026.4.2; >= 2026.5.0-latest, < 2026.5.1
Showing 8