Vulnerabilities

TI-2026-33517 CVE-2026-45780

Discourse: Private event sample invitees are serialized to non-invited event viewers

LOW 31

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00497 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-200

TI-2026-38930 CVE-2026-53963

Discourse: Stored-XSS in 2FA delete confirmation modal

MEDIUM 42

Discourse is an open-source discussion platform.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00735 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-79

TI-2026-42644 CVE-2026-59828

Discourse: Hidden post revisions leak through adjacent visible diffs

LOW 31

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00545 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-200

TI-2026-32671 CVE-2026-44787

Discourse: Signup-time primary_group_id assignment grants whisperer access

MEDIUM 43

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00669 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-269

TI-2026-38929 CVE-2026-53962

Discourse: Insufficient SVG sanitization logic

LOW 25

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00415 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-79

TI-2026-39992 CVE-2026-55424

Discourse: Topic featured link susceptible to stored XSS

LOW 35

Discourse is an open-source discussion platform.

CVSS 4.0HIGH 7.4 Network Low privileges User interaction EPSS 0.00415 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-79

TI-2026-33524 CVE-2026-45788

Discourse: Secure uploads exposed by hotlinked image copying

LOW 29

Discourse is an open-source discussion platform.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00634 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-200

TI-2026-36452 CVE-2026-49256

Discourse: Hidden tag names leaked via category serializers

LOW 29

Discourse is an open-source discussion platform.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00508 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-200

TI-2026-34127 CVE-2026-46413

Discourse: Regular users can route multipart uploads into the admin backup store

LOW 29

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00514 Published 2026-07-09 Fixed in 2026.1.5, 2026.4.2 +1 CWE-862

TI-2026-38928 CVE-2026-53961

Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)

LOW 35

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.003 Published 2026-07-09 Fixed in 2026.5.1, 2026.4.2 +1 CWE-345

TI-2026-39989 CVE-2026-55420

Discourse: Remote code execution via pdf uploads

LOW 38

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00603 Published 2026-07-09 Fixed in 2026.5.1, 2026.4.2 +1 CWE-78

TI-2026-34844 CVE-2026-47264

Discourse: Don't leak restricted tag group names via tag info

LOW 29

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00216 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-200

TI-2026-34843 CVE-2026-47263

Discourse: Prevent webhook payload disclosure on event redelivery

LOW 19

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00211 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-200

TI-2026-33512 CVE-2026-45775

Discourse: Cross-site backup access via path traversal in multisite local backups

LOW 30

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00323 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-22

TI-2026-32932 CVE-2026-45085

Discourse: Chat misauthorization and information disclosure

LOW 29

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00213 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-200

TI-2026-32669 CVE-2026-44785

Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts

LOW 19

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00189 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-200

TI-2026-32668 CVE-2026-44784

Discourse: Non-staff group owners can see email password in plaintext through group history

LOW 28

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00231 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-200

TI-2026-32667 CVE-2026-44783

Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts

LOW 23

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00148 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-284

TI-2026-32666 CVE-2026-44782

Discourse: GroupPostSerializer leaks hidden full names through reaction post association

LOW 19

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00189 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-200

TI-2026-32665 CVE-2026-44780

Discourse: Category queue reviewers can read raw incoming emails from queued posts

LOW 19

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00189 Published 2026-06-12 Fixed in 2026.4.1, 2026.3.1 +1 CWE-200

TI-2026-32664 CVE-2026-44779

Discourse: Bot debug endpoints disclose whisper translation audit logs

LOW 20

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00235 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-200

TI-2026-32670 CVE-2026-44786

Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users

LOW 38

Discourse is an open-source discussion platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00259 Published 2026-06-12 Fixed in 2026.1.4, 2026.3.1 +1 CWE-200

TI-2026-26455 CVE-2026-34154

Discourse has a subscription access bypass in its discourse-subscriptions plugin

LOW 11

Discourse is an open-source discussion platform.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00214 Published 2026-05-19 Fixed in 2026.1.4, 2026.3.1 +2 CWE-862

TI-2026-25910 CVE-2026-33514

Discourse: Information Disclosure in Form Template API Due to Missing Authorization

LOW 26

Discourse is an open-source discussion platform.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.0025 Published 2026-05-19 Fixed in 2026.1.4, 2026.3.1 +2 CWE-862

TI-2026-24773 CVE-2026-32244

Discourse: Cached outdated summaries can leak removed content

LOW 30

Discourse is an open-source discussion platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00233 Published 2026-05-19 Fixed in 2026.1.4, 2026.3.1 +2 CWE-200

Vulnerabilities

Filters