discourse vulnerabilities

CVEs per yearBy the year they were published

1. 202117
2. 202237
3. 202364
4. 202438
5. 202528
6. 2026139

Newest CVEs

• CVE-2017-20290

  Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed

  Discourse · Discourse

  Medium5.1
• CVE-2026-57447

  Discourse Doc Categories: Doc category index refresh leaks private topic titles

  discourse · discourse-doc-categories

  Medium4.3
• CVE-2026-55103

  Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening

  discourse · discourse-activity-pub

  High8.6
• CVE-2026-91157

  Discourse: Media uploads remain publicly accessible after category permissions are restricted

  discourse · discourse

  High7.5
• CVE-2026-91156

  Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

  discourse · discourse

  High7.5
• CVE-2026-91159

  Discourse: Stored oEmbed HTML injection via allowed iframe

  discourse · discourse

  High7.7
• CVE-2026-91119

  Discourse: Encode action_code_who in mention URLs

  discourse · discourse

  Medium6.4
• CVE-2026-91121

  Discourse: Chat upload filenames rendered as raw HTML in excerpts

  discourse · discourse

  Medium5.0
• CVE-2026-91120

  Discourse: Stored HTML injection in video notification emails

  discourse · discourse

  Medium5.4
• CVE-2026-91132

  Discourse: Wildcard iframe origin allowlist bypass via authority separators

  discourse · discourse

  Medium4.3