Skip to content
OpenAdvisories

Vendor

Discourse

323 known vulnerabilities.

Products

Discourse 288 discourse-calendar 7 discourse-reactions 4 discourse-chat 3 discourse-ai 2 discourse-doc-categories 1 discourse-placeholder-theme-component 1 discourse-microsoft-auth 1 discourse-yearly-review 1 discourse-footnote 1 discourse-policy 1 discourse-jira 1 discourse-group-membership-ip-block 1 rails_multisite 1 discourse-bbcode 1 DiscoTOC 1 discourse-code-review 1 discourse-patreon 1 message_bus 1 discourse-assign 1 discourse-mermaid-theme-component 1 discourse-encrypt 1 discourse-activity-pub 1 WP Discourse 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.7
    CVE-2026-91159 Public exploit

    Discourse: Stored oEmbed HTML injection via allowed iframe

    Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured al…

    Discourse Discourse
  • Medium 6.8
    CVE-2024-52794 Public exploit

    Magnific lightbox susceptible to Cross-site Scripting in Discourse

    Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulne…

    Discourse Discourse
  • High 8.2
    CVE-2024-47773 Public exploit

    Anonymous cache poisoning via XHR requests in Discourse

    Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patc…

    Discourse Discourse
  • Medium 5.3
    CVE-2023-47119 Public exploit

    HTML injection in oneboxed links

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. …

    Discourse Discourse
  • Medium 4.3
    CVE-2023-45806 Public exploit

    Discourse vulnerable to DoS via Regexp Injection in Full Name

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to …

    Discourse Discourse
  • High 7.5
    CVE-2023-45131 Public exploit

    Unauthenticated access to new private chat messages in Discourse

    Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade…

    Discourse Discourse