Vulnerabilities in discourse
323 resultsCVE-2023-25819MEDIUMDiscourse tags with no visibility are leaking into og:article:tagEPSS 0.5%CVE-2022-39270MEDIUMArbitrary HTML injection in table-of-contents theme component in DiscoTOCEPSS 0.5%CVE-2022-39279MEDIUMDiscourse-chat plugin susceptible to XSS in channel name and descriptionEPSS 0.5%CVE-2024-28242MEDIUMDisclosure of the existence of secret categories with custom backgrounds in DiscourseEPSS 0.5%CVE-2022-46148HIGHDiscourse allows self-XSS through malicious composer messageEPSS 0.5%CVE-2023-44391MEDIUMPrevent unauthorized access to summary details in DiscourseEPSS 0.5%CVE-2024-23834MEDIUMDiscourse improperly sanitized user input leads to XSSEPSS 0.5%CVE-2026-72729LOWDiscourse: Stored XSS in discourse-local-dates pluginEPSS 0.5%CVE-2026-91157HIGHDiscourse: Media uploads remain publicly accessible after category permissions are restrictedEPSS 0.5%CVE-2023-43659HIGHCross-site Scripting via email preview when CSP disabled in DiscourseEPSS 0.5%CVE-2026-91156HIGHDiscourse: Chat MessageBus delivers read-restricted messages to unauthorized usersEPSS 0.5%CVE-2023-38685MEDIUMDiscourse's restricted tag information visible to unauthenticated usersEPSS 0.5%CVE-2024-38360MEDIUMDenial of service via Watched Words in DiscourseEPSS 0.5%CVE-2024-43789HIGHDenial of service by the absence of restrictions on replies to posts in DiscourseEPSS 0.5%CVE-2024-24748MEDIUMDisclosure of the existence of secret subcategories in DiscourseEPSS 0.5%CVE-2024-53851MEDIUMPartial denial of service via inline oneboxes in DiscourseEPSS 0.5%CVE-2026-72726MEDIUMDiscourse: Unauthorized eavesdropping on private AI bot conversations.EPSS 0.5%CVE-2023-23615MEDIUMMalicious users in Discourse can create spam topics as any user due to improper access controlEPSS 0.5%CVE-2026-72722MEDIUMDiscourse: Duplicate lookup reveals restricted topic titles through canonicalized URLsEPSS 0.4%CVE-2026-33355MEDIUMDiscourse filters whisper posts from private-posts feedEPSS 0.4%