Skip to contentDiscourse vulnerabilities
Newest
- discourseDiscourse vulnerable to DoS via large URL payload in PM to a botCVE-2025-48053Fix available8.7 High
- discourse discourse-policyDiscourse Policy plugin private group members visibleCVE-2025-472883.5 Low
- discourse discourse-code-reviewDiscourse Code Review Plugin vulnerable to XSS via auto link commitsCVE-2025-468243.1 Low
- discoursePrivate data leak on login-required Discourse sitesCVE-2025-468135.8 Medium
- discourseDiscourse DM limits aren’t always properly enforcedCVE-2025-32376Fix available4.8 Medium
- discourseDiscourse may bypass user preference when adding users to chat groupsCVE-2025-24972Fix available4.3 Medium
- discourseDiscourse has race condition when adding users to a group DMCVE-2025-24808Fix available4.3 Medium
- discourseCross-site Scripting (XSS) via topic titles when CSP disabled in DiscourseCVE-2024-53266Fix available4.3 Medium
- discoursePartial denial of service via inline oneboxes in DiscourseCVE-2024-53851Fix available4.3 Medium
- discoursePotential bypass of chat permissions in DiscourseCVE-2024-53994Fix available4.3 Medium
- discourseAnonymous cache poisoning via XHR requests in DiscourseCVE-2024-55948Fix available8.2 High
- discourseUsers can see other user's tagged PMs in DiscourseCVE-2024-56197Fix available2.2 Low
- discourseHTMLi(XSS without CSP) via Onebox urls in DiscourseCVE-2024-56328Fix available6.5 Medium
- discourseClient Side Path Traversal using activate account route in DiscourseCVE-2025-226013.1 Low
- discourseStored DOM-based XSS (without CSP) via video placeholders in DiscourseCVE-2025-22602Fix available6.5 Medium
- discourseAnonymous cache poisoning via request headers in DiscourseCVE-2025-23023Fix available8.2 High
- discourse discourse-aiCross-site Scripting via Discourse-ai SharedAiConversation onebox in DiscourseCVE-2024-541429.1 Critical
- discourseBypass of Discourse Connect using other login paths if enabled in DiscourseCVE-2024-49765Fix available5.3 Medium
- discourseModerators can view Screened emails even when the “moderators view emails” option is disabled in DiscourseCVE-2024-52589Fix available2.2 Low
- discourseMagnific lightbox susceptible to Cross-site Scripting in DiscourseCVE-2024-52794Public exploitFix available6.8 Medium
- discoursePotential Backup file leaked via Nginx in DiscourseCVE-2024-53991Fix availableEPSS 29.9%7.5 High
- discourseAnonymous cache poisoning via XHR requests in DiscourseCVE-2024-47773Public exploitFix available8.2 High
- discourseCross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in DiscourseCVE-2024-47772Fix available6.5 Medium
- discourseDenial of service by the absence of restrictions on replies to posts in DiscourseCVE-2024-43789Fix available7.5 High
- discoursePrevent topic list filtering by hidden tags for unauthorized users in DiscourseCVE-2024-45297Fix available5.3 Medium
- discourseBypass of email address validation via encoded email addresses in DiscourseCVE-2024-45051Fix available8.2 High
- discourse calendar, discourse-calendar +1 moreDiscourse Calendar plugin event names susceptible to XSSCVE-2024-453036.1 Medium
- discourse discourse-calendar, calendar +1 moreInsufficient control of region value length in discourse-calendarCVE-2024-216584.3 Medium
- discourse discourse-placeholder-theme-componentDiscourse Placeholder Forms has a XSS stopped by CSPCVE-2024-434086.3 Medium
- discourseDiscourse allows iframe injection though default site settingCVE-2024-39320Fix available6.1 Medium
- discourseDiscourse vulnerable to DoS via Tag GroupCVE-2024-37299Fix available4.9 Medium
- discourseDiscourse has an XSS via Onebox systemCVE-2024-37165Fix available6.3 Medium
- discourseDenial of service via Watched Words in DiscourseCVE-2024-38360Fix available4.9 Medium
- discourseDiscourse vulnerable to Server-Side Request Forgery via FastImageCVE-2024-37157Fix available6.4 Medium
- discourseDiscourse doesn't limit reviewable user serializer payloadCVE-2024-36122Fix available2.4 Low
- discourseDiscourse missing authorization checks for suspending admins/moderatorsCVE-2024-36113Fix available4.9 Medium
- discourseDiscourse vulnerable to stored-dom XSS via Facebook OneboxesCVE-2024-35234Fix available4.2 Medium
- discourseDiscourse vulnerable to DoS through OneboxCVE-2024-35227Fix available7.5 High
- discourse wp discourseWordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerabilityCVE-2024-351684.3 Medium
- discourse discourse-reactionsDiscourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity pageCVE-2024-312194.3 Medium
- discourseDenial of service through invites in DiscourseCVE-2024-27085Fix available6.5 Medium
- discourseDenial of service via Staff Actions in DiscourseCVE-2024-27100Fix available6.5 Medium
- discourseDisclosure of the existence of secret categories with custom backgrounds in DiscourseCVE-2024-28242Fix available5.3 Medium
- discourseDisclosure of the existence of secret subcategories in DiscourseCVE-2024-24748Fix available5.3 Medium
- discourseNo rate limits on POST /uploads endpoint in DiscourseCVE-2024-24827Fix available5.3 Medium
- discourse calendar, discourse-calendar +1 moreUser can see invitees in events created in PMs and private categoriesCVE-2024-248174.3 Medium
- discourse ai, discourse-ai +1 morediscourse-ai admin-initiated SSRF when interacting with AI servicesCVE-2024-236544.1 Medium
- discourse calendar, discourse-calendar +1 moreUninvited user is able to join and mark the attendance of the the private eventCVE-2024-261456.5 Medium
- discourse, discourse discourse-microsoft-auth, microsoft authentication +2 morePotential account take over due to unverified emails from Microsoft Identity PlatformCVE-2023-462419.1 Critical
- discourse discourse-group-membership-ip-block, group membership ip blocks +1 morediscourse-group-membership-ip-block is exposing potentially sensitive custom fieldsCVE-2024-247554.3 Medium
- Show moreLoading…