discourse

Records329All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high65CVSS 7.0–8.9

Exploited now

discourse records in CISA KEV

No discourse vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Discourse 263 records MEDIUM Calendar 4 records LOW Discourse-chat 3 records LOW Discourse Calendar 3 records LOW Discourse Reactions 2 records LOW Ai 1 record LOW Assign 1 record LOW Discotoc 1 record LOW

Records

263 records in Discourse · all components

TI-2021-19656 CVE-2021-43850

Denial of Service in discourse

MEDIUM 63

Discourse is an open source platform for community discussion.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00855 Published 2022-01-04 Fixed in 2.7.12, 2.8.0.beta10 CWE-20

TI-2024-36150 CVE-2024-53991

Potential Backup file leaked via Nginx in Discourse

MEDIUM 62

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.2988 Published 2024-12-19 No fix listed CWE-200

TI-2021-18002 CVE-2021-41163

RCE via malicious SNS subscription payload

MEDIUM 61

Discourse is an open source platform for community discussion.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.19812 Published 2021-10-20 No fix listed CWE-74

TI-2026-24651 CVE-2026-32113

Discourse: Open redirect via `sso_destination_url` cookie in `enter`

MEDIUM 56

Discourse is an open-source discussion platform.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00201 Published 2026-03-31 Fixed in 2026.1.3, 2026.2.2 +1 CWE-601

TI-2026-22278 CVE-2026-27934

Discourse leaks private topic title and post excerpt via user action API endpoint

MEDIUM 46

Discourse is an open-source discussion platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01218 Published 2026-03-19 Fixed in 2026.1.2, 2026.2.1 CWE-201

TI-2023-24152 CVE-2023-45131

Unauthenticated access to new private chat messages in Discourse

MEDIUM 46

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04041 Published 2023-10-16 No fix listed CWE-200

TI-2024-33232 CVE-2024-49765

Bypass of Discourse Connect using other login paths if enabled in Discourse

MEDIUM 45

Discourse is an open source platform for community discussion.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00363 Published 2024-12-19 No fix listed CWE-359

TI-2024-32048 CVE-2024-47773

Anonymous cache poisoning via XHR requests in Discourse

MEDIUM 45

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01805 Published 2024-10-08 No fix listed CWE-610

TI-2023-09450 CVE-2023-23621

Discourse vulnerable to ReDoS in user agent parsing

MEDIUM 45

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00892 Published 2023-01-27 Fixed in 3.0.1 CWE-1333

TI-2022-16489 CVE-2022-36066

Discourse vulnerable to RCE via admins uploading maliciously zipped file

MEDIUM 45

Discourse is an open source discussion platform.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02077 Published 2022-09-29 Fixed in 2.8.9, 2.9.0.beta10 CWE-434

TI-2025-30424 CVE-2025-48053

Discourse vulnerable to DoS via large URL payload in PM to a bot

MEDIUM 44

Discourse is an open-source discussion platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00386 Published 2025-06-09 Fixed in 3.4.4, 3.5.0.beta5 +1 CWE-400

TI-2026-32671 CVE-2026-44787

Discourse: Signup-time primary_group_id assignment grants whisperer access

MEDIUM 43

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00669 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-269

TI-2023-25461 CVE-2023-47121

Discourse SSRF vulnerability in Embedding

MEDIUM 43

Discourse is an open source platform for community discussion.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00692 Published 2023-11-10 Fixed in 3.1.3, 3.2.0.beta3 CWE-918

TI-2026-38930 CVE-2026-53963

Discourse: Stored-XSS in 2FA delete confirmation modal

MEDIUM 42

Discourse is an open-source discussion platform.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00735 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-79

TI-2025-42155 CVE-2025-68662

FinalDestination hostname matching allows SSRF protection bypass

MEDIUM 42

Discourse is an open source discussion platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00327 Published 2026-01-28 Fixed in 3.5.4, 2025.11.2 +2 CWE-918

TI-2025-31027 CVE-2025-48877

Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe

MEDIUM 42

Discourse is an open-source discussion platform.

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00426 Published 2025-06-09 Fixed in 3.4.4, 3.5.0.beta5 +1 CWE-1038

TI-2024-30163 CVE-2024-45051

Bypass of email address validation via encoded email addresses in Discourse

MEDIUM 42

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00371 Published 2024-10-07 No fix listed CWE-287

TI-2022-18731 CVE-2022-39356

Discourse user account takeover via email and invite link

MEDIUM 42

Discourse is a platform for community discussion.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00712 Published 2022-11-02 No fix listed CWE-285

TI-2026-24360 CVE-2026-31805

Discourse has a poll authorization bypass via post_id array parameter

MEDIUM 41

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00244 Published 2026-03-20 Fixed in 2026.1.2, 2026.2.1 CWE-20

TI-2026-21235 CVE-2026-26265

Discourse has IDOR vulnerability in the directory items endpoint

MEDIUM 41

Discourse is an open source discussion platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01273 Published 2026-02-26 Fixed in 2025.12.2, 2026.1.1 +1 CWE-863

TI-2025-16834 CVE-2025-23023

Anonymous cache poisoning via request headers in Discourse

MEDIUM 41

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00257 Published 2025-02-04 No fix listed CWE-346

TI-2024-36989 CVE-2024-55948

Anonymous cache poisoning via XHR requests in Discourse

MEDIUM 41

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00257 Published 2025-02-04 No fix listed CWE-346

TI-2023-25460 CVE-2023-47120

Discourse DoS through Onebox favicon URL

MEDIUM 41

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00982 Published 2023-11-10 Fixed in 3.1.3, 3.2.0.beta3 CWE-770

TI-2023-08717 CVE-2023-22468

Discourse vulnerable to Cross-site Scripting in local oneboxes

MEDIUM 41

Discourse is an open source platform for community discussion.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00518 Published 2023-01-26 No fix listed CWE-79

TI-2024-23297 CVE-2024-35227

Discourse vulnerable to DoS through Onebox

MEDIUM 40

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0059 Published 2024-07-03 No fix listed CWE-20

Open these records in search →