Skip to content
OpenAdvisories

Vendor

Discourse

323 known vulnerabilities.

Products

Discourse 288 discourse-calendar 7 discourse-reactions 4 discourse-chat 3 discourse-ai 2 discourse-doc-categories 1 discourse-placeholder-theme-component 1 discourse-microsoft-auth 1 discourse-yearly-review 1 discourse-footnote 1 discourse-policy 1 discourse-jira 1 discourse-group-membership-ip-block 1 rails_multisite 1 discourse-bbcode 1 DiscoTOC 1 discourse-code-review 1 discourse-patreon 1 message_bus 1 discourse-assign 1 discourse-mermaid-theme-component 1 discourse-encrypt 1 discourse-activity-pub 1 WP Discourse 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.7
    CVE-2026-91159 Public exploit

    Discourse: Stored oEmbed HTML injection via allowed iframe

    Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured al…

    Discourse Discourse
  • High 8.2
    CVE-2024-47773 Public exploit

    Anonymous cache poisoning via XHR requests in Discourse

    Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patc…

    Discourse Discourse
  • High 7.5
    CVE-2023-45131 Public exploit

    Unauthenticated access to new private chat messages in Discourse

    Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade…

    Discourse Discourse