discourse
Number 56 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Discourse, discourse
Total vulnerabilities
323
Critical
6
High
51
Known Exploited
0
Exploit available
1
Network, no login needed
34.4%
Of 323 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 139 | 1 | 20 | 98 | 19 | 1 |
| 2025 | 28 | 1 | 7 | 14 | 6 | 0 |
| 2024 | 38 | 1 | 6 | 27 | 4 | 0 |
| 2023 | 64 | 0 | 9 | 43 | 12 | 0 |
| 2022 | 37 | 2 | 5 | 27 | 3 | 0 |
| 2021 | 17 | 1 | 4 | 12 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| discourse | 287 | 49 |
| discourse-calendar | 7 | 1 |
| discourse-reactions | 4 | 0 |
| discourse-chat | 3 | 0 |
| discourse-ai | 2 | 1 |
| DiscoTOC | 1 | 0 |
| Discourse | 1 | 0 |
| WP Discourse | 1 | 0 |
| discourse-activity-pub | 1 | 1 |
| discourse-assign | 1 | 0 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Information Disclosure | 78 | 6 |
| Cross-Site Scripting | 60 | 17 |
| Missing Authorization | 31 | 4 |
| Incorrect Authorization | 22 | 4 |
| Denial of Service | 16 | 4 |
| Allocation of Resources Without Limits or Throttling | 15 | 1 |
| Improper Access Control | 10 | 0 |
| Improper Input Validation | 9 | 1 |
| Server-Side Request Forgery | 8 | 2 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 5 | 2 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2017-20290 | Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed | Medium | 0.3% | |
| CVE-2026-57447 | Discourse Doc Categories: Doc category index refresh leaks private topic titles | Medium | 0.2% | |
| CVE-2026-55103 | Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening | High | 0.2% | |
| CVE-2026-91159 | Discourse: Stored oEmbed HTML injection via allowed iframe | High | 0.4% | |
| CVE-2026-91157 | Discourse: Media uploads remain publicly accessible after category permissions are restricted | High | 0.5% | |
| CVE-2026-91156 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users | High | 0.5% | |
| CVE-2026-91134 | Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist | Medium | 0.2% | |
| CVE-2026-91133 | Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure | Medium | 0.3% | |
| CVE-2026-91132 | Discourse: Wildcard iframe origin allowlist bypass via authority separators | Medium | 0.1% | |
| CVE-2026-91123 | Discourse: Reject literal backslash path separators in iframe src traversal guard | High | 0.3% |