CVE Tools
Track your stack

Discourse

271 CVEs tracked since 2019. Since Jul 2019, none of them reached CISA KEV.

Discourse CVEs per month

Jul 2019 to Aug 2026. Point at a month, or focus the strip and use the arrow keys.
Discourse CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2019-0720
2019-08null or fewer
2019-09null or fewer
2019-10null or fewer
2019-11null or fewer
2019-12null or fewer
2020-01null or fewer
2020-02null or fewer
2020-03null or fewer
2020-04null or fewer
2020-05null or fewer
2020-06null or fewer
2020-07null or fewer
2020-08null or fewer
2020-09null or fewer
2020-10null or fewer
2020-11null or fewer
2020-12null or fewer
2021-01null or fewer
2021-02null or fewer
2021-03null or fewer
2021-04null or fewer
2021-05null or fewer
2021-06null or fewer
2021-0720
2021-0840
2021-0930
2021-1020
2021-1120
2021-1250
2022-0150
2022-02null or fewer
2022-03null or fewer
2022-0440
2022-05null or fewer
2022-0650
2022-07null or fewer
2022-08null or fewer
2022-0960
2022-1030
2022-11100
2022-12null or fewer
2023-01160
2023-02null or fewer
2023-03null or fewer
2023-0450
2023-05null or fewer
2023-0640
2023-0790
2023-08null or fewer
2023-0950
2023-1080
2023-1160
2023-12null or fewer
2024-0150
2024-0250
2024-0350
2024-04null or fewer
2024-05null or fewer
2024-06null or fewer
2024-0790
2024-08null or fewer
2024-09null or fewer
2024-1050
2024-11null or fewer
2024-1240
2025-01null or fewer
2025-0290
2025-03null or fewer
2025-04null or fewer
2025-05null or fewer
2025-0650
2025-07null or fewer
2025-08null or fewer
2025-09null or fewer
2025-10null or fewer
2025-11null or fewer
2025-12null or fewer
2026-01140
2026-02170
2026-03480
2026-04null or fewer
2026-05null or fewer
2026-06110
2026-07110
2026-08170

Products

The products that kept showing up in Discourse's monthly top three, with their CVEs summed over those months.

  1. Discourse24732 months
  2. Discourse-calendar43 months
  3. Calendar32 months
  4. Discourse-chat33 months
  5. Discourse-reactions33 months
  6. Discourse Reactions22 months
  7. Assign11 month
  8. Discotoc11 month
  9. Discourse Bbcode11 month
  10. Discourse Calendar11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Discourse.

  1. CVE-2026-91119Discourse: Encode action_code_who in mention URLs6.4
  2. CVE-2026-91121Discourse: Chat upload filenames rendered as raw HTML in excerpts5.0
  3. CVE-2026-91120Discourse: Stored HTML injection in video notification emails5.4
  4. CVE-2026-91132Discourse: Wildcard iframe origin allowlist bypass via authority separators4.3
  5. CVE-2026-91122Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users8.7
  6. CVE-2026-91123Discourse: Reject literal backslash path separators in iframe src traversal guard7.2
  7. CVE-2026-91133Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure6.5
  8. CVE-2026-91134Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist5.4
  9. CVE-2026-84302Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables4.2
  10. CVE-2026-59830Discourse: Stored XSS via unescaped actor name in post actions5.4
  11. CVE-2026-53960Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD5.3
  12. CVE-2026-55704Discourse: Shared-draft titles and excerpts leak through group post serialization4.3
  13. CVE-2026-55674Discourse: Cache poisoning/XSS via color scheme cookies9.3
  14. CVE-2026-59829Discourse: Review queue exposes flag-related private message excerpts to category group moderators4.3
  15. CVE-2026-72732Discourse: Templates endpoint exposes hidden tag names4.3

The record

Peak rank
#24 in Mar 2026
Busiest month shown
Mar 2026, 48 CVEs
Months with a KEV entry
0 since Jul 2019
Monthly snapshots
34 since 2019
Discourse's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store