CVE Tools
Track your stack

Discourse

281 CVEs tracked since 2019. Since Jul 2019, none of them reached CISA KEV.

Discourse CVEs per month

Jul 2019 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Discourse CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2019-0720
2019-082 or fewer
2019-092 or fewer
2019-102 or fewer
2019-112 or fewer
2019-122 or fewer
2020-012 or fewer
2020-022 or fewer
2020-032 or fewer
2020-04no snapshot
2020-05no snapshot
2020-062 or fewer
2020-07no snapshot
2020-082 or fewer
2020-091 or fewer
2020-101 or fewer
2020-111 or fewer
2020-122 or fewer
2021-012 or fewer
2021-022 or fewer
2021-03no snapshot
2021-042 or fewer
2021-052 or fewer
2021-062 or fewer
2021-0720
2021-0840
2021-0930
2021-1020
2021-1120
2021-1250
2022-0150
2022-022 or fewer
2022-033 or fewer
2022-0440
2022-053 or fewer
2022-0650
2022-073 or fewer
2022-083 or fewer
2022-0960
2022-1030
2022-11100
2022-123 or fewer
2023-01160
2023-023 or fewer
2023-03no snapshot
2023-0450
2023-053 or fewer
2023-0640
2023-0790
2023-084 or fewer
2023-0950
2023-1080
2023-1160
2023-124 or fewer
2024-0150
2024-0250
2024-0350
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-0790
2024-084 or fewer
2024-093 or fewer
2024-1050
2024-114 or fewer
2024-1240
2025-014 or fewer
2025-0290
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-0650
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-01140
2026-02170
2026-03480
2026-046 or fewer
2026-057 or fewer
2026-06110
2026-07110
2026-08170
2026-09100
2026-1011 or fewer
2026-110

Products

The products that kept showing up in Discourse's monthly top three, with their CVEs summed over those months.

  1. Discourse25733 months
  2. Discourse-calendar43 months
  3. Calendar32 months
  4. Discourse-chat33 months
  5. Discourse-reactions33 months
  6. Discourse Reactions22 months
  7. Assign11 month
  8. Discotoc11 month
  9. Discourse Bbcode11 month
  10. Discourse Calendar11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Discourse.

  1. CVE-2017-20290Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed6.1
  2. CVE-2026-57447Discourse Doc Categories: Doc category index refresh leaks private topic titles4.3
  3. CVE-2026-55103Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening8.6
  4. CVE-2026-91157Discourse: Media uploads remain publicly accessible after category permissions are restricted7.5
  5. CVE-2026-91156Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users7.5
  6. CVE-2026-91159Discourse: Stored oEmbed HTML injection via allowed iframe7.7
  7. CVE-2026-91119Discourse: Encode action_code_who in mention URLs6.4
  8. CVE-2026-91121Discourse: Chat upload filenames rendered as raw HTML in excerpts5.0
  9. CVE-2026-91120Discourse: Stored HTML injection in video notification emails5.4
  10. CVE-2026-91132Discourse: Wildcard iframe origin allowlist bypass via authority separators4.3
  11. CVE-2026-91122Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users8.7
  12. CVE-2026-91123Discourse: Reject literal backslash path separators in iframe src traversal guard7.2
  13. CVE-2026-91133Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure6.5
  14. CVE-2026-91134Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist5.4
  15. CVE-2026-84302Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables4.2

The record

Peak rank
#24 in Mar 2026
Busiest month shown
Mar 2026, 48 CVEs
Months with a KEV entry
0 since Jul 2019
Monthly snapshots
35 since 2019
Discourse's full record, month by month