[ Vendor · 15 CVEs ]
discourse
CVEs affecting discourse published in the last 30 days, plus any discourse CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2017-20290 | 22 Oct 2026 | CVSS 6.1 | DiscourseDiscourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject… | |
| CVE-2026-57447 | 16 Oct 2026 | CVSS 4.3 | discourse-doc-categoriesDiscourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index… | |
| CVE-2026-55103 | 15 Oct 2026 | CVSS 8.6 | discourse-activity-pubDiscourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing… | |
| CVE-2026-91156 | 14 Oct 2026 | CVSS 7.5 | discourseDiscourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver… | |
| CVE-2026-91157 | 14 Oct 2026 | CVSS 7.5 | discourseDiscourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not… | |
| CVE-2026-91159 | 14 Oct 2026 | CVSS 7.7 | discourseDiscourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire… | |
| CVE-2026-91119 | 24 Sep 2026 | CVSS 6.4 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log… | |
| CVE-2026-91120 | 24 Sep 2026 | CVSS 5.4 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video… | |
| CVE-2026-91121 | 24 Sep 2026 | CVSS 5.0 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in… | |
| CVE-2026-91134 | 24 Sep 2026 | CVSS 5.4 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored… | |
| CVE-2026-91122 | 24 Sep 2026 | CVSS 8.7 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted… | |
| CVE-2026-91123 | 24 Sep 2026 | CVSS 7.2 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat… | |
| CVE-2026-91132 | 24 Sep 2026 | CVSS 4.3 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the… | |
| CVE-2026-91133 | 24 Sep 2026 | CVSS 6.5 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL… | |
| CVE-2026-84302 | 24 Sep 2026 | CVSS 4.2 | discourseDiscourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with… |