discourse

Records329All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high65CVSS 7.0–8.9

Exploited now

discourse records in CISA KEV

No discourse vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Discourse 263 records MEDIUM Calendar 4 records LOW Discourse-chat 3 records LOW Discourse Calendar 3 records LOW Discourse Reactions 2 records LOW Ai 1 record LOW Assign 1 record LOW Discotoc 1 record LOW

Records

329 records

TI-2022-22806 CVE-2022-46162

Discourse BBCode plugin vulnerable to arbitrary CSS injection

HIGH 76

discourse-bbcode is the official BBCode plugin for Discourse.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01208 Published 2022-11-30 Fixed in 91478f5cfecdcc43cf85b997168a8ecfd0f8df90 CWE-74

TI-2021-19656 CVE-2021-43850

Denial of Service in discourse

MEDIUM 63

Discourse is an open source platform for community discussion.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00855 Published 2022-01-04 Fixed in 2.7.12, 2.8.0.beta10 CWE-20

TI-2024-36150 CVE-2024-53991

Potential Backup file leaked via Nginx in Discourse

MEDIUM 62

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.2988 Published 2024-12-19 No fix listed CWE-200

TI-2021-18002 CVE-2021-41163

RCE via malicious SNS subscription payload

MEDIUM 61

Discourse is an open source platform for community discussion.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.19812 Published 2021-10-20 No fix listed CWE-74

TI-2026-24651 CVE-2026-32113

Discourse: Open redirect via `sso_destination_url` cookie in `enter`

MEDIUM 56

Discourse is an open-source discussion platform.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00201 Published 2026-03-31 Fixed in 2026.1.3, 2026.2.2 +1 CWE-601

TI-2022-18730 CVE-2022-39355

Discourse Patreon vulnerable to improper validation of email during Patreon authentication

MEDIUM 51

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00978 Published 2022-10-26 Fixed in 846d012151514b35ce42a1636c7d70f6dcee879e CWE-287

TI-2026-22278 CVE-2026-27934

Discourse leaks private topic title and post excerpt via user action API endpoint

MEDIUM 46

Discourse is an open-source discussion platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01218 Published 2026-03-19 Fixed in 2026.1.2, 2026.2.1 CWE-201

TI-2023-24152 CVE-2023-45131

Unauthenticated access to new private chat messages in Discourse

MEDIUM 46

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04041 Published 2023-10-16 No fix listed CWE-200

TI-2024-33232 CVE-2024-49765

Bypass of Discourse Connect using other login paths if enabled in Discourse

MEDIUM 45

Discourse is an open source platform for community discussion.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00363 Published 2024-12-19 No fix listed CWE-359

TI-2024-32048 CVE-2024-47773

Anonymous cache poisoning via XHR requests in Discourse

MEDIUM 45

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01805 Published 2024-10-08 No fix listed CWE-610

TI-2023-09450 CVE-2023-23621

Discourse vulnerable to ReDoS in user agent parsing

MEDIUM 45

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00892 Published 2023-01-27 Fixed in 3.0.1 CWE-1333

TI-2022-16489 CVE-2022-36066

Discourse vulnerable to RCE via admins uploading maliciously zipped file

MEDIUM 45

Discourse is an open source discussion platform.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02077 Published 2022-09-29 Fixed in 2.8.9, 2.9.0.beta10 CWE-434

TI-2025-30424 CVE-2025-48053

Discourse vulnerable to DoS via large URL payload in PM to a bot

MEDIUM 44

Discourse is an open-source discussion platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00386 Published 2025-06-09 Fixed in 3.4.4, 3.5.0.beta5 +1 CWE-400

TI-2026-74866 CVE-2026-55103

Discourse ActivityPub lets remote actors edit or delete federated posts

MEDIUM 43

Discourse ActivityPub adds ActivityPub support to Discourse.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.002 Published 2026-10-15 Fixed in 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 CWE-345

TI-2026-40196 CVE-2026-55674

Discourse: Cache poisoning/XSS via color scheme cookies

MEDIUM 43

Discourse is an open-source discussion platform.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.0059 Published 2026-08-17 Fixed in 2026.1.6, 2026.5.2 +1 CWE-79

TI-2026-32671 CVE-2026-44787

Discourse: Signup-time primary_group_id assignment grants whisperer access

MEDIUM 43

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00669 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-269

TI-2023-25461 CVE-2023-47121

Discourse SSRF vulnerability in Embedding

MEDIUM 43

Discourse is an open source platform for community discussion.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00692 Published 2023-11-10 Fixed in 3.1.3, 3.2.0.beta3 CWE-918

TI-2023-24868 CVE-2023-46241

Potential account take over due to unverified emails from Microsoft Identity Platform

MEDIUM 43

`discourse-microsoft-auth` is a plugin that enables authentication via Microsoft.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00798 Published 2024-02-21 No fix listed CWE-863

TI-2026-38930 CVE-2026-53963

Discourse: Stored-XSS in 2FA delete confirmation modal

MEDIUM 42

Discourse is an open-source discussion platform.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00735 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-79

TI-2025-42155 CVE-2025-68662

FinalDestination hostname matching allows SSRF protection bypass

MEDIUM 42

Discourse is an open source discussion platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00327 Published 2026-01-28 Fixed in 3.5.4, 2025.11.2 +2 CWE-918

TI-2025-31027 CVE-2025-48877

Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe

MEDIUM 42

Discourse is an open-source discussion platform.

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00426 Published 2025-06-09 Fixed in 3.4.4, 3.5.0.beta5 +1 CWE-1038

TI-2024-36258 CVE-2024-54142

Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse

MEDIUM 42

Discourse AI is a Discourse plugin which provides a number of AI features.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00433 Published 2025-01-14 Fixed in 92f122c CWE-79

TI-2024-30163 CVE-2024-45051

Bypass of email address validation via encoded email addresses in Discourse

MEDIUM 42

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00371 Published 2024-10-07 No fix listed CWE-287

TI-2022-18731 CVE-2022-39356

Discourse user account takeover via email and invite link

MEDIUM 42

Discourse is a platform for community discussion.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00712 Published 2022-11-02 No fix listed CWE-285

TI-2026-24360 CVE-2026-31805

Discourse has a poll authorization bypass via post_id array parameter

MEDIUM 41

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00244 Published 2026-03-20 Fixed in 2026.1.2, 2026.2.1 CWE-20

Open these records in search →