Discourse discourse

• CVE-2026-27740 Medium 5.1 Discourse has Stored XSS in AI Triage Automation 0.3%
• CVE-2026-27570 Medium 5.1 Discourse Vulnerable to Stored XSS via Shared AI Conversation Onebox 0.4%
• CVE-2026-27491 Medium 6.9 Discourse has a bypass of official warnings messages by non-staff users 0.3%
• CVE-2026-27454 Medium 5.3 Discourse has check revision visibility on posts endpoint 1.0%
• CVE-2026-27166 Medium 4.1 Discourse vulnerable to HTML injection via prohibited iframe URLs 0.2%
• CVE-2026-28227 Low 1.2 Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category 3.3%
• CVE-2026-28219 Low 1.3 Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners 0.2%
• CVE-2026-28218 Medium 5.3 Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution 0.2%
• CVE-2026-27154 Low 1.3 Discourse has XSS when editing a malicious post 0.2%
• CVE-2026-27153 Low 1.3 Discourse doesn't prevent moderators from exporting user Chat DMs 0.2%
• CVE-2026-27152 Low 1.3 DIscourse has DM communication-preference bypass when adding members 0.2%
• CVE-2026-27162 Medium 4.9 DIscourse doesn't prevent whispers to leak in excerpts 0.3%
• CVE-2026-27151 Low 1.3 Discourse doesn't validate destination topic when moving posts 0.2%
• CVE-2026-27150 Low 1.3 Discourse doesn't ensure guardian check when creating QueryGroupBookmark 0.2%
• CVE-2026-27149 Medium 4.9 Discourse has SQL injection in PM tag filtering 0.3%
• CVE-2026-27021 Medium 6.9 Discourse: Poll voters endpoint lacked post visibility checks 0.3%
• CVE-2026-26979 None 0.0 Discourse: TL4 users are able to change status of restricted topics 0.2%
• CVE-2026-26973 Medium 4.3 Discourse doesn't scope reviewable notes to user-visible reviewables 0.2%
• CVE-2026-26265 High 7.5 Discourse has IDOR vulnerability in the directory items endpoint 1.3%
• CVE-2026-26207 Medium 5.4 DIscourse's discourse-policy plugin lacks post access check 0.2%
• CVE-2026-26078 High 7.5 Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint 0.3%
• CVE-2026-26077 Medium 6.5 Discourse doesn't ensure webhooks require a token 0.9%
• CVE-2026-24742 Medium 6.5 Discourse staff action logs expose sensitive information to moderators 0.3%
• CVE-2026-23743 Medium 6.9 Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized users 0.3%
• CVE-2026-21865 Medium 6.5 Discourse topic conversion permission vulnerability for moderators 0.3%
• CVE-2025-69289 Medium 5.1 Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change 0.2%
• CVE-2025-69218 High 7.1 Discourse moderators can access admin-only reports exposing private upload URLs 0.3%
• CVE-2025-68934 Medium 6.5 Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint 0.3%
• CVE-2025-68933 Medium 6.9 Discourse non-admin moderators can exfiltrate private content via post ownership transfer 0.2%
• CVE-2025-68666 Medium 5.9 Discourse users archives leaked to users with moderation privileges 0.3%
• CVE-2025-68662 High 7.6 FinalDestination hostname matching allows SSRF protection bypass 0.3%
• CVE-2025-68660 Medium 5.3 Discourse AI Discover's continue conversation allows threat actor to impersonate user 0.2%
• CVE-2025-68659 Medium 4.3 Discourse has DoS vulnerability in username change endpoint 0.3%
• CVE-2025-68479 High 7.1 Discourse subscriptions are susceptible to takeover 0.2%
• CVE-2025-67723 Medium 4.6 Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin 0.2%
• CVE-2025-66488 Medium 4.6 Discourse allows script execution in uploaded HTML/XML files on S3 0.2%
• CVE-2025-64528 Medium 6.3 Users are able to find users by name even when `enable_names` is off 0.3%
• CVE-2025-61598 Medium 6.3 Discourse is missing Cache-Control response header on error responses 0.3%
• CVE-2025-59337 Medium 5.5 Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments 0.3%
• CVE-2025-58055 Medium 4.3 Discourse AI Suggestions Contain Insecure Direct Object Reference 0.3%
• CVE-2025-58054 Low 3.5 Discourse is vulnerable to XSS when quoting chat messages 0.2%
• CVE-2025-54411 Low 2.4 Discourse welcome banner user name XSS 0.2%
• CVE-2025-53102 High 8.2 Discourse's WebAuthn challenge isn't cleared from user session after authentication 0.5%
• CVE-2025-49845 Medium 6.3 Discourse users are able to see their own whispers even after being removed from a group that has been configured to see whispers 0.4%
• CVE-2025-48954 High 8.1 Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow 0.7%
• CVE-2025-48877 High 8.1 Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe 0.4%
• CVE-2025-48062 High 7.1 Discourse vulnerable to HTML injection when inviting to topic via email 0.3%
• CVE-2025-48053 High 8.7 Discourse vulnerable to DoS via large URL payload in PM to a bot 0.4%
• CVE-2025-46813 Medium 5.8 Private data leak on login-required Discourse sites 0.4%
• CVE-2025-32376 Medium 4.8 Discourse DM limits aren’t always properly enforced 0.3%