Exposure of Discourse

Message boards
87
exposure score
2,279
sites use
0
exploited
3
critical

CVEs

290 results
CVE-2024-53266MEDIUMCross-site Scripting (XSS) via topic titles when CSP disabled in DiscourseEPSS 0.3%CVE-2023-37904LOWDiscourse Race Condition in Accept InviteEPSS 0.3%CVE-2026-55704MEDIUMDiscourse: Shared-draft titles and excerpts leak through group post serializationEPSS 0.3%CVE-2026-33422LOWDiscourse exposes ip_address of flagged userEPSS 0.3%CVE-2025-69218HIGHDiscourse moderators can access admin-only reports exposing private upload URLsEPSS 0.3%CVE-2017-20290MEDIUMDiscourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribedEPSS 0.3%CVE-2026-21865MEDIUMDiscourse topic conversion permission vulnerability for moderatorsEPSS 0.3%CVE-2026-27162MEDIUMDIscourse doesn't prevent whispers to leak in excerptsEPSS 0.3%CVE-2023-45816LOWUnread bookmark reminder notifications that the user cannot access can be seenEPSS 0.3%CVE-2026-91122HIGHDiscourse: Chat MessageBus delivers read-restricted messages to unauthorized usersEPSS 0.3%CVE-2025-32376MEDIUMDiscourse DM limits aren’t always properly enforcedEPSS 0.3%CVE-2026-33393MEDIUMDiscourse fixes loose hostname matching in spam host allowlistEPSS 0.3%CVE-2025-58055MEDIUMDiscourse AI Suggestions Contain Insecure Direct Object ReferenceEPSS 0.3%CVE-2026-44786HIGHDiscourse: Public chat MessageBus broadcasts are not restricted to chat-eligible usersEPSS 0.3%CVE-2026-91121MEDIUMDiscourse: Chat upload filenames rendered as raw HTML in excerptsEPSS 0.3%CVE-2026-27149MEDIUMDiscourse has SQL injection in PM tag filteringEPSS 0.3%CVE-2024-52589LOWModerators can view Screened emails even when the “moderators view emails” option is disabled in DiscourseEPSS 0.3%CVE-2025-23023HIGHAnonymous cache poisoning via request headers in DiscourseEPSS 0.3%CVE-2024-55948HIGHAnonymous cache poisoning via XHR requests in DiscourseEPSS 0.3%CVE-2026-26078HIGHDiscourse has authentication bypass vulnerability in the Patreon plugin webhook endpointEPSS 0.3%