Discourse Discourse vulnerabilities

CVEs per yearBy the year they were published

1. 202113
2. 202228
3. 202358
4. 202427
5. 202525
6. 2026137

Newest CVEs

• CVE-2017-20290

  Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed

  Discourse · Discourse

  Medium5.1
• CVE-2026-91157

  Discourse: Media uploads remain publicly accessible after category permissions are restricted

  discourse · discourse

  High7.5
• CVE-2026-91156

  Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

  discourse · discourse

  High7.5
• CVE-2026-91159

  Discourse: Stored oEmbed HTML injection via allowed iframe

  discourse · discourse

  High7.7
• CVE-2026-91119

  Discourse: Encode action_code_who in mention URLs

  discourse · discourse

  Medium6.4
• CVE-2026-91121

  Discourse: Chat upload filenames rendered as raw HTML in excerpts

  discourse · discourse

  Medium5.0
• CVE-2026-91120

  Discourse: Stored HTML injection in video notification emails

  discourse · discourse

  Medium5.4
• CVE-2026-91132

  Discourse: Wildcard iframe origin allowlist bypass via authority separators

  discourse · discourse

  Medium4.3
• CVE-2026-91122

  Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

  discourse · discourse

  High8.7
• CVE-2026-91123

  Discourse: Reject literal backslash path separators in iframe src traversal guard

  discourse · discourse

  High7.2