Affected version lines
- 2026.6 11 CVEs
- 2026.5 25 CVEs
- 2026.4 25 CVEs
- 2026.3 64 CVEs
- 2026.2 67 CVEs
- 2026.1 105 CVEs
- 2025.12 37 CVEs
- 2025.11 44 CVEs
- 2021.0 29 CVEs
- 3.6 34 CVEs
- 3.5 57 CVEs
- 3.4 75 CVEs
- 3.3 89 CVEs
- 3.2 108 CVEs
- 3.1 143 CVEs
- 3.0 150 CVEs
- 2.9 172 CVEs
- 2.8 189 CVEs
- 2.7 192 CVEs
- 2.6 193 CVEs
- 2.5 192 CVEs
- 2.4 194 CVEs
- 2.3 194 CVEs
- 2.2 194 CVEs
- 2.1 194 CVEs
- 2.0 194 CVEs
- 1.9 194 CVEs
- 1.8 194 CVEs
- 1.7 194 CVEs
- 1.6 194 CVEs
- 1.5 194 CVEs
- 1.4 194 CVEs
- 1.3 194 CVEs
- 1.2 194 CVEs
- 1.1 194 CVEs
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2017-20290 | Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed | ≥ 1.9.0.beta2 < 1.9.0.beta13 | 5.1 | — | 2026-10-22 | |
| CVE-2026-91157 | Discourse: Media uploads remain publicly accessible after category permissions are restricted | * | 7.5 | — | 2026-10-15 | |
| CVE-2026-91156 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users | * | 7.5 | — | 2026-10-15 | |
| CVE-2026-91159 | Discourse: Stored oEmbed HTML injection via allowed iframe | * | 7.7 | — | 2026-10-15 | |
| CVE-2026-91119 | Discourse: Encode action_code_who in mention URLs | * | 6.4 | — | 2026-09-25 | |
| CVE-2026-91121 | Discourse: Chat upload filenames rendered as raw HTML in excerpts | * | 5.0 | — | 2026-09-25 | |
| CVE-2026-91120 | Discourse: Stored HTML injection in video notification emails | * | 5.4 | — | 2026-09-25 | |
| CVE-2026-91132 | Discourse: Wildcard iframe origin allowlist bypass via authority separators | * | 4.3 | — | 2026-09-25 | |
| CVE-2026-91122 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users | * | 8.7 | — | 2026-09-25 | |
| CVE-2026-91123 | Discourse: Reject literal backslash path separators in iframe src traversal guard | * | 7.2 | — | 2026-09-25 | |
| CVE-2026-91133 | Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure | * | 6.5 | — | 2026-09-25 | |
| CVE-2026-91134 | Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist | * | 5.4 | — | 2026-09-25 | |
| CVE-2026-84302 | Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables | * | 4.2 | — | 2026-09-25 | |
| CVE-2026-59830 | Discourse: Stored XSS via unescaped actor name in post actions | * | 5.4 | — | 2026-09-22 | |
| CVE-2026-53960 | Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD | * | 5.3 | — | 2026-08-18 | |
| CVE-2026-55704 | Discourse: Shared-draft titles and excerpts leak through group post serialization | * | 4.3 | — | 2026-08-18 | |
| CVE-2026-55674 | Discourse: Cache poisoning/XSS via color scheme cookies | * | 9.3 | — | 2026-08-18 | |
| CVE-2026-59829 | Discourse: Review queue exposes flag-related private message excerpts to category group moderators | * | 4.3 | — | 2026-08-18 | |
| CVE-2026-72732 | Discourse: Templates endpoint exposes hidden tag names | * | 4.3 | — | 2026-08-11 | |
| CVE-2026-72731 | Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer | * | 7.1 | — | 2026-08-11 | |
| CVE-2026-72730 | Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor | * | 8.7 | — | 2026-08-11 | |
| CVE-2026-72729 | Discourse: Stored XSS in discourse-local-dates plugin | * | 2.0 | — | 2026-08-11 | |
| CVE-2026-72728 | Discourse: Onebox iframe origin allowlist enforces URL authority boundary | * | 6.3 | — | 2026-08-11 | |
| CVE-2026-72727 | Discourse: Stored XSS in the moderation review queue | * | 4.8 | — | 2026-08-11 | |
| CVE-2026-72726 | Discourse: Unauthorized eavesdropping on private AI bot conversations. | * | 6.5 | — | 2026-08-11 | |
| CVE-2026-72725 | Discourse: Stored XSS in staff action logs injects staff UI | * | 5.4 | — | 2026-08-11 | |
| CVE-2026-72724 | Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch | * | 4.3 | — | 2026-08-11 | |
| CVE-2026-72723 | Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags | * | 5.3 | — | 2026-08-11 | |
| CVE-2026-72722 | Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs | * | 4.3 | — | 2026-08-11 | |
| CVE-2026-72721 | Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison | * | 5.3 | — | 2026-08-11 | |
| CVE-2026-72720 | Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing | * | 6.4 | — | 2026-08-11 | |
| CVE-2026-59828 | Discourse: Hidden post revisions leak through adjacent visible diffs | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 5.3 | — | 2026-07-09 | |
| CVE-2026-55424 | Discourse: Topic featured link susceptible to stored XSS | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 7.4 | — | 2026-07-09 | |
| CVE-2026-49256 | Discourse: Hidden tag names leaked via category serializers | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 6.3 | — | 2026-07-09 | |
| CVE-2026-46413 | Discourse: Regular users can route multipart uploads into the admin backup store | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 6.5 | — | 2026-07-09 | |
| CVE-2026-53961 | Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding) | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 6.5 | — | 2026-07-09 | |
| CVE-2026-53962 | Discourse: Insufficient SVG sanitization logic | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 5.4 | — | 2026-07-09 | |
| CVE-2026-53963 | Discourse: Stored-XSS in 2FA delete confirmation modal | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 9.0 | — | 2026-07-09 | |
| CVE-2026-45780 | Discourse: Private event sample invitees are serialized to non-invited event viewers | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 4.3 | — | 2026-07-09 | |
| CVE-2026-45788 | Discourse: Secure uploads exposed by hotlinked image copying | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 6.3 | — | 2026-07-09 | |
| CVE-2026-44787 | Discourse: Signup-time primary_group_id assignment grants whisperer access | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 7.1 | — | 2026-07-09 | |
| CVE-2026-55420 | Discourse: Remote code execution via pdf uploads | * ≥ 2026.1.0 < 2026.1.5 ≥ 2026.4.0 < 2026.4.2 | 8.1 | — | 2026-07-09 | |
| CVE-2026-47263 | Discourse: Prevent webhook payload disclosure on event redelivery | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 4.3 | — | 2026-06-12 | |
| CVE-2026-47264 | Discourse: Don't leak restricted tag group names via tag info | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 5.3 | — | 2026-06-12 | |
| CVE-2026-45085 | Discourse: Chat misauthorization and information disclosure | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 5.3 | — | 2026-06-12 | |
| CVE-2026-45775 | Discourse: Cross-site backup access via path traversal in multisite local backups | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 6.8 | — | 2026-06-12 | |
| CVE-2026-44786 | Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 7.5 | — | 2026-06-12 | |
| CVE-2026-44784 | Discourse: Non-staff group owners can see email password in plaintext through group history | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 6.5 | — | 2026-06-12 | |
| CVE-2026-44785 | Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 4.3 | — | 2026-06-12 | |
| CVE-2026-44782 | Discourse: GroupPostSerializer leaks hidden full names through reaction post association | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 4.3 | — | 2026-06-12 | |
| CVE-2026-44780 | Discourse: Category queue reviewers can read raw incoming emails from queued posts | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 4.3 | — | 2026-06-12 | |
| CVE-2026-44783 | Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 5.4 | — | 2026-06-12 | |
| CVE-2026-44779 | Discourse: Bot debug endpoints disclose whisper translation audit logs | * < 2026.1.0 ≥ 2026.1.0 < 2026.1.4 | 4.3 | — | 2026-06-12 | |
| CVE-2026-34154 | Discourse has a subscription access bypass in its discourse-subscriptions plugin | * ≥ 2026.1.0 < 2026.1.4 ≥ 2026.3.0 < 2026.3.1 | 2.1 | — | 2026-05-19 | |
| CVE-2026-33514 | Discourse: Information Disclosure in Form Template API Due to Missing Authorization | * ≥ 2026.1.0 < 2026.1.4 ≥ 2026.3.0 < 2026.3.1 | 6.0 | — | 2026-05-19 | |
| CVE-2026-32244 | Discourse: Cached outdated summaries can leak removed content | * ≥ 2026.1.0 < 2026.1.4 ≥ 2026.3.0 < 2026.3.1 | 5.3 | — | 2026-05-19 | |
| CVE-2026-34947 | Discourse: Staged user custom fields are exposed on public invite pages | * ≥ 2026.1.0 ≤ 2026.1.2 ≥ 2026.2.0 ≤ 2026.2.1 | 2.7 | — | 2026-04-03 | |
| CVE-2026-27481 | Discourse: Hidden tag visibility bypass on tag routes | * ≥ 2026.1.0 ≤ 2026.1.2 ≥ 2026.2.0 ≤ 2026.2.1 | 6.3 | — | 2026-04-03 | |
| CVE-2026-33415 | Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure | * ≥ 2026.1.0 < 2026.1.3 ≥ 2026.2.0 < 2026.2.2 | 5.1 | — | 2026-03-31 | |
| CVE-2026-33300 | Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` e... | * ≥ 2026.1.0 < 2026.1.3 ≥ 2026.2.0 < 2026.2.2 | 5.3 | — | 2026-03-31 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).