Vendor
Discourse
323 known vulnerabilities.
Discourse at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 6 | 0 |
| Sep 2026 | 10 | 0 |
| Aug 2026 | 17 | 1 |
| Jul 2026 | 11 | 0 |
| Jun 2026 | 11 | 0 |
| May 2026 | 3 | 0 |
| Apr 2026 | 2 | 0 |
| Mar 2026 | 48 | 0 |
| Feb 2026 | 17 | 0 |
| Jan 2026 | 14 | 0 |
| Dec 2025 | 1 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 4 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 1 | 0 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 5 | 0 |
| May 2025 | 3 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 2 | 0 |
| Feb 2025 | 9 | 0 |
| Jan 2025 | 1 | 1 |
| Dec 2024 | 4 | 0 |
Most common weaknesses
Products
323 results · Feed
-
Medium 6.1
Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payl…
-
Medium 4.3
Discourse Doc Categories: Doc category index refresh leaks private topic titles
Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's au…
-
High 8.6
Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor an…
-
High 7.5
Discourse: Media uploads remain publicly accessible after category permissions are restricted
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when catego…
-
High 7.5
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but …
-
High 7.7CVE-2026-91159 Public exploit
Discourse: Stored oEmbed HTML injection via allowed iframe
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured al…
-
Medium 6.4
Discourse: Encode action_code_who in mention URLs
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL enco…
-
Medium 5.0
Discourse: Chat upload filenames rendered as raw HTML in excerpts
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could …
-
Medium 5.4
Discourse: Stored HTML injection in video notification emails
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with s…
-
Medium 4.3
Discourse: Wildcard iframe origin allowlist bypass via authority separators
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separa…
-
High 8.7
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user wi…
-
High 7.2
Discourse: Reject literal backslash path separators in iframe src traversal guard
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allo…
-
Medium 6.5
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records i…
-
Medium 5.4
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo.…
-
Medium 4.2
Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message.…
-
Medium 5.4
Discourse: Stored XSS via unescaped actor name in post actions
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name coul…
-
Medium 5.3
Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data, exposing it to any un…
-
Medium 4.3
Discourse: Shared-draft titles and excerpts leak through group post serialization
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group pos…
-
Critical 9.3
Discourse: Cache poisoning/XSS via color scheme cookies
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse p…
-
Medium 4.3
Discourse: Review queue exposes flag-related private message excerpts to category group moderators
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even wh…
-
Medium 4.3
Discourse: Templates endpoint exposes hidden tag names
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/disc…
-
High 7.1
Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer
Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft…
-
High 8.7
Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2…
-
Low 2.0
Discourse: Stored XSS in discourse-local-dates plugin
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This i…
-
Medium 6.3
Discourse: Onebox iframe origin allowlist enforces URL authority boundary
Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.…
-
Medium 4.8
Discourse: Stored XSS in the moderation review queue
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a sit…
-
Medium 6.5
Discourse: Unauthorized eavesdropping on private AI bot conversations.
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, an…
-
Medium 5.4
Discourse: Stored XSS in staff action logs injects staff UI
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2…
-
Medium 4.3
Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can p…
-
Medium 5.3
Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_…
-
Medium 4.3
Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing inter…
-
Medium 5.3
Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configur…
-
Medium 6.4
Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, se…
-
Medium 5.3
Discourse: Private event sample invitees are serialized to non-invited event viewers
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view …
-
High 7.3
Discourse: Stored-XSS in 2FA delete confirmation modal
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when…
-
Medium 5.3
Discourse: Hidden post revisions leak through adjacent visible diffs
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer. Thi…
-
High 8.2
Discourse: Signup-time primary_group_id assignment grants whisperer access
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites wit…
-
Medium 5.4
Discourse: Insufficient SVG sanitization logic
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally p…
-
High 7.4
Discourse: Topic featured link susceptible to stored XSS
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to i…
-
Medium 6.3
Discourse: Secure uploads exposed by hotlinked image copying
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an attacker knew the secured upload URL and the secure_uploads site setting was enabled. This i…