Vulnerabilities in discourse
323 resultsCVE-2025-22602MEDIUMStored DOM-based XSS (without CSP) via video placeholders in DiscourseEPSS 0.4%CVE-2024-21658MEDIUMInsufficient control of region value length in discourse-calendarEPSS 0.4%CVE-2024-56328MEDIUMHTMLi(XSS without CSP) via Onebox urls in DiscourseEPSS 0.4%CVE-2023-32061MEDIUMDiscourse Topic Creation Page Allows iFrame Tag without RestrictionsEPSS 0.4%CVE-2024-56197LOWUsers can see other user's tagged PMs in DiscourseEPSS 0.4%CVE-2026-28282LOWDiscourse vulnerable to group membership addition permission bypass via discourse-policy pluginEPSS 0.4%CVE-2023-26040MEDIUMDiscourse chat messages susceptible to Cross-site Scripting through chat excerptsEPSS 0.4%CVE-2024-37157MEDIUMDiscourse vulnerable to Server-Side Request Forgery via FastImageEPSS 0.3%CVE-2026-27491MEDIUMDiscourse has a bypass of official warnings messages by non-staff usersEPSS 0.3%CVE-2024-39320MEDIUMDiscourse allows iframe injection though default site settingEPSS 0.3%CVE-2026-27740MEDIUMDiscourse has Stored XSS in AI Triage AutomationEPSS 0.3%CVE-2026-72732MEDIUMDiscourse: Templates endpoint exposes hidden tag namesEPSS 0.3%CVE-2025-46824LOWDiscourse Code Review Plugin vulnerable to XSS via auto link commitsEPSS 0.3%CVE-2024-35234MEDIUMDiscourse vulnerable to stored-dom XSS via Facebook OneboxesEPSS 0.3%CVE-2025-68662HIGHFinalDestination hostname matching allows SSRF protection bypassEPSS 0.3%CVE-2024-45297MEDIUMPrevent topic list filtering by hidden tags for unauthorized users in DiscourseEPSS 0.3%CVE-2024-47772MEDIUMCross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in DiscourseEPSS 0.3%CVE-2026-27936MEDIUMDiscourse discloses restricted post-action counts to non-privileged usersEPSS 0.3%CVE-2026-45775MEDIUMDiscourse: Cross-site backup access via path traversal in multisite local backupsEPSS 0.3%CVE-2026-32099MEDIUMDiscourse prevents hidden profile data leak via user oneboxEPSS 0.3%