Skip to content
OpenAdvisories

Vendor

Discourse

323 known vulnerabilities.

Products

Discourse 288 discourse-calendar 7 discourse-reactions 4 discourse-chat 3 discourse-ai 2 discourse-doc-categories 1 discourse-placeholder-theme-component 1 discourse-microsoft-auth 1 discourse-yearly-review 1 discourse-footnote 1 discourse-policy 1 discourse-jira 1 discourse-group-membership-ip-block 1 rails_multisite 1 discourse-bbcode 1 DiscoTOC 1 discourse-code-review 1 discourse-patreon 1 message_bus 1 discourse-assign 1 discourse-mermaid-theme-component 1 discourse-encrypt 1 discourse-activity-pub 1 WP Discourse 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-55674

    Discourse: Cache poisoning/XSS via color scheme cookies

    Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse p…

    Discourse Discourse
  • Critical 9.1
    CVE-2024-54142

    Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse

    Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox t…

    Discourse discourse-ai
  • Critical 9.1
    CVE-2023-46241

    Potential account take over due to unverified emails from Microsoft Identity Platform

    `discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enabled, an attack can potentially take control of a victim's Discourse account. Sites that have configured their application…

    Discourse discourse-microsoft-auth
  • Critical 9.1
    CVE-2022-39355

    Discourse Patreon vulnerable to improper validation of email during Patreon authentication

    Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in co…

    Discourse discourse-patreon
  • Critical 9.1
    CVE-2022-36066

    Discourse vulnerable to RCE via admins uploading maliciously zipped file

    Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary…

    Discourse Discourse
  • Critical 10.0
    CVE-2021-41163 EPSS 20%

    RCE via malicious SNS subscription payload

    Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, …

    Discourse Discourse