CVE Tools
Track your stack

Discourse

294 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Discourse, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Discourse CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Discourse CVEs per month
MonthCVEs
2024-110
2024-124
2025-010
2025-029
2025-032
2025-041
2025-051
2025-065
2025-071
2025-081
2025-090
2025-104
2025-110
2025-121
2026-0114
2026-0217
2026-0348
2026-042
2026-053
2026-0611
2026-0711
2026-0817
2026-0910
2026-104

Severity

How the 294 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical52%
  • High5017%
  • Medium20570%
  • Low3211%

Latest CVEs

The 15 most recently published vulnerabilities affecting Discourse.

  1. CVE-2017-20290Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed6.1
  2. CVE-2026-91157Discourse: Media uploads remain publicly accessible after category permissions are restricted7.5
  3. CVE-2026-91156Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users7.5
  4. CVE-2026-91159Discourse: Stored oEmbed HTML injection via allowed iframe7.7
  5. CVE-2026-91119Discourse: Encode action_code_who in mention URLs6.4
  6. CVE-2026-91121Discourse: Chat upload filenames rendered as raw HTML in excerpts5.0
  7. CVE-2026-91120Discourse: Stored HTML injection in video notification emails5.4
  8. CVE-2026-91132Discourse: Wildcard iframe origin allowlist bypass via authority separators4.3
  9. CVE-2026-91122Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users8.7
  10. CVE-2026-91123Discourse: Reject literal backslash path separators in iframe src traversal guard7.2
  11. CVE-2026-91133Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure6.5
  12. CVE-2026-91134Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist5.4
  13. CVE-2026-84302Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables4.2
  14. CVE-2026-59830Discourse: Stored XSS via unescaped actor name in post actions5.4
  15. CVE-2026-53960Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD5.3

Product grouping is registry-driven, with AI assist and human review. How it works