Vulnerabilities in discourse
323 resultsCVE-2026-59830MEDIUMDiscourse: Stored XSS via unescaped actor name in post actionsEPSS 0.3%CVE-2024-52794MEDIUMMagnific lightbox susceptible to Cross-site Scripting in DiscourseEPSS 0.3%CVE-2024-53994MEDIUMPotential bypass of chat permissions in DiscourseEPSS 0.3%CVE-2025-64528MEDIUMUsers are able to find users by name even when `enable_names` is offEPSS 0.3%CVE-2026-91123HIGHDiscourse: Reject literal backslash path separators in iframe src traversal guardEPSS 0.3%CVE-2026-27935MEDIUMDiscourse leaks private topic metadata to non-authorized usersEPSS 0.3%CVE-2026-91133MEDIUMDiscourse: Escape LIKE metacharacters in upload paths to prevent disclosureEPSS 0.3%CVE-2025-68934MEDIUMDiscourse Has Denial of Service (DoS) Vulnerability in Drafts Creation EndpointEPSS 0.3%CVE-2024-53266MEDIUMCross-site Scripting (XSS) via topic titles when CSP disabled in DiscourseEPSS 0.3%CVE-2023-37904LOWDiscourse Race Condition in Accept InviteEPSS 0.3%CVE-2026-33422LOWDiscourse exposes ip_address of flagged userEPSS 0.3%CVE-2026-55704MEDIUMDiscourse: Shared-draft titles and excerpts leak through group post serializationEPSS 0.3%CVE-2026-33393MEDIUMDiscourse fixes loose hostname matching in spam host allowlistEPSS 0.3%CVE-2025-69218HIGHDiscourse moderators can access admin-only reports exposing private upload URLsEPSS 0.3%CVE-2017-20290MEDIUMDiscourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribedEPSS 0.3%CVE-2025-47288LOWDiscourse Policy plugin private group members visibleEPSS 0.3%CVE-2023-45816LOWUnread bookmark reminder notifications that the user cannot access can be seenEPSS 0.3%CVE-2026-21865MEDIUMDiscourse topic conversion permission vulnerability for moderatorsEPSS 0.3%CVE-2026-27162MEDIUMDIscourse doesn't prevent whispers to leak in excerptsEPSS 0.3%CVE-2025-32376MEDIUMDiscourse DM limits aren’t always properly enforcedEPSS 0.3%