Discourse
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| discourse | 287 | – | Oct 14, 2026 |
| discourse-calendar | 7 | – | Sep 12, 2024 |
| discourse-reactions | 4 | – | Apr 15, 2024 |
| discourse-chat | 3 | – | Oct 6, 2022 |
| discourse-ai | 2 | – | Jan 14, 2025 |
| discourse-doc-categories | 1 | – | Oct 16, 2026 |
| discourse-encrypt | 1 | – | Sep 28, 2023 |
| discourse-footnote | 1 | – | Dec 14, 2021 |
| discourse-group-membership-ip-block | 1 | – | Feb 1, 2024 |
| discourse-jira | 1 | – | Oct 6, 2023 |
| discourse-mermaid-theme-component | 1 | – | Jan 4, 2023 |
| discourse-microsoft-auth | 1 | – | Feb 21, 2024 |
| discourse-patreon | 1 | – | Oct 26, 2022 |
| discourse-placeholder-theme-component | 1 | – | Aug 20, 2024 |
| discourse-policy | 1 | – | May 29, 2025 |
| discourse-yearly-review | 1 | – | Mar 6, 2023 |
| message_bus | 1 | – | Dec 17, 2021 |
| rails_multisite | 1 | – | Nov 15, 2021 |
| DiscoTOC | 1 | – | Oct 6, 2022 |
| WP Discourse | 1 | – | Jun 11, 2024 |
| discourse-activity-pub | 1 | – | Oct 15, 2026 |
| discourse-assign | 1 | – | Apr 26, 2022 |
| discourse-bbcode | 1 | – | Nov 30, 2022 |
| discourse-code-review | 1 | – | May 7, 2025 |
Exploited and recent CVEs
- CVE-2026-57447 Discourse Doc Categories: Doc category index refresh leaks private topic titles 0.2%
- CVE-2026-55103 Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening 0.2%
- CVE-2026-91157 Discourse: Media uploads remain publicly accessible after category permissions are restricted 0.5%
- CVE-2026-91156 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users 0.5%
- CVE-2026-91159 Discourse: Stored oEmbed HTML injection via allowed iframe 0.4%
- CVE-2026-91119 Discourse: Encode action_code_who in mention URLs 0.2%
- CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts 0.3%
- CVE-2026-91120 Discourse: Stored HTML injection in video notification emails 0.2%
- CVE-2026-91132 Discourse: Wildcard iframe origin allowlist bypass via authority separators 0.1%
- CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users 0.3%
- CVE-2026-91123 Discourse: Reject literal backslash path separators in iframe src traversal guard 0.3%
- CVE-2026-91133 Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure 0.3%
- CVE-2026-91134 Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist 0.2%
- CVE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables 0.2%
- CVE-2026-59830 Discourse: Stored XSS via unescaped actor name in post actions 0.3%
- CVE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD 0.3%
- CVE-2026-55704 Discourse: Shared-draft titles and excerpts leak through group post serialization 0.3%
- CVE-2026-55674 Discourse: Cache poisoning/XSS via color scheme cookies 0.6%
- CVE-2026-59829 Discourse: Review queue exposes flag-related private message excerpts to category group moderators 0.4%
- CVE-2026-72732 Discourse: Templates endpoint exposes hidden tag names 0.3%
- CVE-2026-72731 Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer 0.4%
- CVE-2026-72730 Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor 0.4%
- CVE-2026-72729 Discourse: Stored XSS in discourse-local-dates plugin 0.5%
- CVE-2026-72728 Discourse: Onebox iframe origin allowlist enforces URL authority boundary 0.3%
- CVE-2026-72727 Discourse: Stored XSS in the moderation review queue 0.4%
- CVE-2026-72726 Discourse: Unauthorized eavesdropping on private AI bot conversations. 0.5%
- CVE-2026-72725 Discourse: Stored XSS in staff action logs injects staff UI 0.3%
- CVE-2026-72724 Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch 0.6%
- CVE-2026-72723 Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags 0.5%
- CVE-2026-72722 Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs 0.4%