DI
Vendor
discourse
324
CVEs
0
On KEV
6
New 30D
Products
DI9.9
discourse
discourse
294 CVEs0 on KEV4 new
DI8.6
discourse-activity-pub
discourse
1 CVEs0 on KEV1 new
DI4.3
discourse-doc-categories
discourse
1 CVEs0 on KEV1 new
CA6.1
Calendar
Discourse
4 CVEs0 on KEV0 new
DC6.1
Discourse Calendar
Discourse
3 CVEs0 on KEV0 new
DI6.5
discourse-chat
discourse
3 CVEs0 on KEV0 new
DR5.3
Discourse Reactions
Discourse
2 CVEs0 on KEV0 new
AI7.2
AI
Discourse
1 CVEs0 on KEV0 new
AS4.3
Assign
Discourse
1 CVEs0 on KEV0 new
DI5.4
DiscoTOC
discourse
1 CVEs0 on KEV0 new
DB9.8
Discourse Bbcode
Discourse
1 CVEs0 on KEV0 new
DI6.1
Discourse-encrypt
Discourse
1 CVEs0 on KEV0 new
DF4.3
Discourse Footnote
Discourse
1 CVEs0 on KEV0 new
DJ4.1
Discourse Jira
Discourse
1 CVEs0 on KEV0 new
DI9.8
discourse-patreon
discourse
1 CVEs0 on KEV0 new
DY5.3
Discourse Yearly Review
Discourse
1 CVEs0 on KEV0 new
GM5.3
Group Membership IP Blocks
Discourse
1 CVEs0 on KEV0 new
ME5.4
Mermaid
Discourse
1 CVEs0 on KEV0 new
MB6.5
Message Bus
Discourse
1 CVEs0 on KEV0 new
MA8.1
Microsoft Authentication
Discourse
1 CVEs0 on KEV0 new
PA9.8
Patreon
Discourse
1 CVEs0 on KEV0 new
RM8.8
Rails Multisite
Discourse
1 CVEs0 on KEV0 new
RE5.3
Reactions
Discourse
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2017-20290 New | DI Discourse Discourse | 6.1 | Oct 22 | Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed |
| CVE-2026-57447 | DI discourse-doc-categories discourse | 4.3 | Oct 16 | Discourse Doc Categories: Doc category index refresh leaks private topic titles |
| CVE-2026-55103 | DI discourse-activity-pub discourse | 8.6 | Oct 15 | Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening |
| CVE-2026-91157 | DI discourse discourse | 7.5 | Oct 14 | Discourse: Media uploads remain publicly accessible after category permissions are restricted |
| CVE-2026-91156 | DI discourse discourse | 7.5 | Oct 14 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users |
| CVE-2026-91159 | DI discourse discourse | 7.7 | Oct 14 | Discourse: Stored oEmbed HTML injection via allowed iframe |
| CVE-2026-91119 | DI discourse discourse | 6.4 | Sep 24 | Discourse: Encode action_code_who in mention URLs |
| CVE-2026-91121 | DI discourse discourse | 5.0 | Sep 24 | Discourse: Chat upload filenames rendered as raw HTML in excerpts |
| CVE-2026-91120 | DI discourse discourse | 5.4 | Sep 24 | Discourse: Stored HTML injection in video notification emails |
| CVE-2026-91132 | DI discourse discourse | 4.3 | Sep 24 | Discourse: Wildcard iframe origin allowlist bypass via authority separators |
| CVE-2026-91122 | DI discourse discourse | 8.7 | Sep 24 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users |
| CVE-2026-91123 | DI discourse discourse | 7.2 | Sep 24 | Discourse: Reject literal backslash path separators in iframe src traversal guard |
| CVE-2026-91133 | DI discourse discourse | 6.5 | Sep 24 | Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure |
| CVE-2026-91134 | DI discourse discourse | 5.4 | Sep 24 | Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist |
| CVE-2026-84302 | DI discourse discourse | 4.2 | Sep 24 | Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables |
| CVE-2026-59830 | DI discourse discourse | 5.4 | Sep 21 | Discourse: Stored XSS via unescaped actor name in post actions |
| CVE-2026-53960 | DI discourse discourse | 5.3 | Aug 17 | Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD |
| CVE-2026-55704 | DI discourse discourse | 4.3 | Aug 17 | Discourse: Shared-draft titles and excerpts leak through group post serialization |
| CVE-2026-55674 | DI discourse discourse | 9.3 | Aug 17 | Discourse: Cache poisoning/XSS via color scheme cookies |
| CVE-2026-59829 | DI discourse discourse | 4.3 | Aug 17 | Discourse: Review queue exposes flag-related private message excerpts to category group moderators |
| CVE-2026-72732 | DI discourse discourse | 4.3 | Aug 10 | Discourse: Templates endpoint exposes hidden tag names |
| CVE-2026-72731 | DI discourse discourse | 7.1 | Aug 10 | Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer |
| CVE-2026-72730 | DI discourse discourse | 8.7 | Aug 10 | Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor |
| CVE-2026-72729 | DI discourse discourse | 2.0 | Aug 10 | Discourse: Stored XSS in discourse-local-dates plugin |
| CVE-2026-72728 | DI discourse discourse | 6.3 | Aug 10 | Discourse: Onebox iframe origin allowlist enforces URL authority boundary |
| CVE-2026-72727 | DI discourse discourse | 4.8 | Aug 10 | Discourse: Stored XSS in the moderation review queue |
| CVE-2026-72726 | DI discourse discourse | 6.5 | Aug 10 | Discourse: Unauthorized eavesdropping on private AI bot conversations. |
| CVE-2026-72725 | DI discourse discourse | 5.4 | Aug 10 | Discourse: Stored XSS in staff action logs injects staff UI |
| CVE-2026-72724 | DI discourse discourse | 4.3 | Aug 10 | Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch |
| CVE-2026-72723 | DI discourse discourse | 5.3 | Aug 10 | Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags |
| CVE-2026-72722 | DI discourse discourse | 4.3 | Aug 10 | Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs |
| CVE-2026-72721 | DI discourse discourse | 5.3 | Aug 10 | Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison |
| CVE-2026-72720 | DI discourse discourse | 6.4 | Aug 10 | Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing |
| CVE-2026-45780 | DI discourse discourse | 4.3 | Jul 9 | Discourse: Private event sample invitees are serialized to non-invited event viewers |
| CVE-2026-53963 | DI discourse discourse | 9.0 | Jul 9 | Discourse: Stored-XSS in 2FA delete confirmation modal |
| CVE-2026-59828 | DI discourse discourse | 5.3 | Jul 9 | Discourse: Hidden post revisions leak through adjacent visible diffs |
| CVE-2026-44787 | DI discourse discourse | 7.1 | Jul 9 | Discourse: Signup-time primary_group_id assignment grants whisperer access |
| CVE-2026-53962 | DI discourse discourse | 5.4 | Jul 9 | Discourse: Insufficient SVG sanitization logic |
| CVE-2026-55424 | DI discourse discourse | 5.4 | Jul 9 | Discourse: Topic featured link susceptible to stored XSS |
| CVE-2026-45788 | DI discourse discourse | 7.5 | Jul 9 | Discourse: Secure uploads exposed by hotlinked image copying |
| CVE-2026-49256 | DI discourse discourse | 7.5 | Jul 9 | Discourse: Hidden tag names leaked via category serializers |
| CVE-2026-46413 | DI discourse discourse | 6.5 | Jul 9 | Discourse: Regular users can route multipart uploads into the admin backup store |
| CVE-2026-53961 | DI discourse discourse | 6.5 | Jul 9 | Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding) |
| CVE-2026-55420 | DI discourse discourse | 8.1 | Jul 9 | Discourse: Remote code execution via pdf uploads |
| CVE-2026-47264 | DI discourse discourse | 5.3 | Jun 12 | Discourse: Don't leak restricted tag group names via tag info |
| CVE-2026-47263 | DI discourse discourse | 4.3 | Jun 12 | Discourse: Prevent webhook payload disclosure on event redelivery |
| CVE-2026-45775 | DI discourse discourse | 6.8 | Jun 12 | Discourse: Cross-site backup access via path traversal in multisite local backups |
| CVE-2026-45085 | DI discourse discourse | 5.3 | Jun 12 | Discourse: Chat misauthorization and information disclosure |
| CVE-2026-44785 | DI discourse discourse | 4.3 | Jun 12 | Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts |
| CVE-2026-44784 | DI discourse discourse | 6.5 | Jun 12 | Discourse: Non-staff group owners can see email password in plaintext through group history |
| CVE-2026-44783 | DI discourse discourse | 5.4 | Jun 12 | Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts |
| CVE-2026-44782 | DI discourse discourse | 4.3 | Jun 12 | Discourse: GroupPostSerializer leaks hidden full names through reaction post association |
| CVE-2026-44780 | DI discourse discourse | 4.3 | Jun 12 | Discourse: Category queue reviewers can read raw incoming emails from queued posts |
| CVE-2026-44779 | DI discourse discourse | 4.3 | Jun 12 | Discourse: Bot debug endpoints disclose whisper translation audit logs |
| CVE-2026-44786 | DI discourse discourse | 7.5 | Jun 12 | Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users |
| CVE-2026-34154 | DI discourse discourse | 5.3 | May 19 | Discourse has a subscription access bypass in its discourse-subscriptions plugin |
| CVE-2026-33514 | DI discourse discourse | 4.3 | May 19 | Discourse: Information Disclosure in Form Template API Due to Missing Authorization |
| CVE-2026-32244 | DI discourse discourse | 5.3 | May 19 | Discourse: Cached outdated summaries can leak removed content |
| CVE-2026-34947 | DI discourse discourse | 5.3 | Apr 3 | Discourse: Staged user custom fields are exposed on public invite pages |
| CVE-2026-27481 | DI discourse discourse | 5.3 | Apr 3 | Discourse: Hidden tag visibility bypass on tag routes |