# Discourse. Every CVE that names Discourse among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed](https://agentprime.io/advisories/CVE-2017-20290.md) `CVE-2017-20290` · CVE record: Discourse Discourse · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Media uploads remain publicly accessible after category permissions are restricted](https://agentprime.io/advisories/CVE-2026-91157.md) `CVE-2026-91157` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Broken access control - [Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users](https://agentprime.io/advisories/CVE-2026-91156.md) `CVE-2026-91156` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control - [Discourse: Stored oEmbed HTML injection via allowed iframe](https://agentprime.io/advisories/CVE-2026-91159.md) `CVE-2026-91159` · CVE record: discourse discourse · CVSS 7.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Encode action_code_who in mention URLs](https://agentprime.io/advisories/CVE-2026-91119.md) `CVE-2026-91119` · CVE record: discourse discourse · CVSS 6.4 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Chat upload filenames rendered as raw HTML in excerpts](https://agentprime.io/advisories/CVE-2026-91121.md) `CVE-2026-91121` · CVE record: discourse discourse · CVSS 5.0 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Stored HTML injection in video notification emails](https://agentprime.io/advisories/CVE-2026-91120.md) `CVE-2026-91120` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Wildcard iframe origin allowlist bypass via authority separators](https://agentprime.io/advisories/CVE-2026-91132.md) `CVE-2026-91132` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-346 - [Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users](https://agentprime.io/advisories/CVE-2026-91122.md) `CVE-2026-91122` · CVE record: discourse discourse · CVSS 8.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Reject literal backslash path separators in iframe src traversal guard](https://agentprime.io/advisories/CVE-2026-91123.md) `CVE-2026-91123` · CVE record: discourse discourse · CVSS 7.2 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal - [Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure](https://agentprime.io/advisories/CVE-2026-91133.md) `CVE-2026-91133` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection - [Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist](https://agentprime.io/advisories/CVE-2026-91134.md) `CVE-2026-91134` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-20 - [Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables](https://agentprime.io/advisories/CVE-2026-84302.md) `CVE-2026-84302` · CVE record: discourse discourse · CVSS 4.2 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control - [Discourse: Stored XSS via unescaped actor name in post actions](https://agentprime.io/advisories/CVE-2026-59830.md) `CVE-2026-59830` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD](https://agentprime.io/advisories/CVE-2026-53960.md) `CVE-2026-53960` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Discourse: Shared-draft titles and excerpts leak through group post serialization](https://agentprime.io/advisories/CVE-2026-55704.md) `CVE-2026-55704` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Discourse: Cache poisoning/XSS via color scheme cookies](https://agentprime.io/advisories/CVE-2026-55674.md) `CVE-2026-55674` · CVE record: discourse discourse · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Review queue exposes flag-related private message excerpts to category group moderators](https://agentprime.io/advisories/CVE-2026-59829.md) `CVE-2026-59829` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Discourse: Templates endpoint exposes hidden tag names](https://agentprime.io/advisories/CVE-2026-72732.md) `CVE-2026-72732` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control - [Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer](https://agentprime.io/advisories/CVE-2026-72731.md) `CVE-2026-72731` · CVE record: discourse discourse · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection - [Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor](https://agentprime.io/advisories/CVE-2026-72730.md) `CVE-2026-72730` · CVE record: discourse discourse · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Stored XSS in discourse-local-dates plugin](https://agentprime.io/advisories/CVE-2026-72729.md) `CVE-2026-72729` · CVE record: discourse discourse · CVSS 2.0 Low · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Onebox iframe origin allowlist enforces URL authority boundary](https://agentprime.io/advisories/CVE-2026-72728.md) `CVE-2026-72728` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-20 - [Discourse: Stored XSS in the moderation review queue](https://agentprime.io/advisories/CVE-2026-72727.md) `CVE-2026-72727` · CVE record: discourse discourse · CVSS 4.8 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Unauthorized eavesdropping on private AI bot conversations.](https://agentprime.io/advisories/CVE-2026-72726.md) `CVE-2026-72726` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Information disclosure - [Discourse: Stored XSS in staff action logs injects staff UI](https://agentprime.io/advisories/CVE-2026-72725.md) `CVE-2026-72725` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch](https://agentprime.io/advisories/CVE-2026-72724.md) `CVE-2026-72724` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control - [Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags](https://agentprime.io/advisories/CVE-2026-72723.md) `CVE-2026-72723` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control - [Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs](https://agentprime.io/advisories/CVE-2026-72722.md) `CVE-2026-72722` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control - [Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison](https://agentprime.io/advisories/CVE-2026-72721.md) `CVE-2026-72721` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-178 - [Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing](https://agentprime.io/advisories/CVE-2026-72720.md) `CVE-2026-72720` · CVE record: discourse discourse · CVSS 6.4 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Private event sample invitees are serialized to non-invited event viewers](https://agentprime.io/advisories/CVE-2026-45780.md) `CVE-2026-45780` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Information disclosure - [Discourse: Stored-XSS in 2FA delete confirmation modal](https://agentprime.io/advisories/CVE-2026-53963.md) `CVE-2026-53963` · CVE record: discourse discourse · CVSS 7.3 High · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Hidden post revisions leak through adjacent visible diffs](https://agentprime.io/advisories/CVE-2026-59828.md) `CVE-2026-59828` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Information disclosure - [Discourse: Signup-time primary_group_id assignment grants whisperer access](https://agentprime.io/advisories/CVE-2026-44787.md) `CVE-2026-44787` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation - [Discourse: Insufficient SVG sanitization logic](https://agentprime.io/advisories/CVE-2026-53962.md) `CVE-2026-53962` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Topic featured link susceptible to stored XSS](https://agentprime.io/advisories/CVE-2026-55424.md) `CVE-2026-55424` · CVE record: discourse discourse · CVSS 7.4 High · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS) - [Discourse: Secure uploads exposed by hotlinked image copying](https://agentprime.io/advisories/CVE-2026-45788.md) `CVE-2026-45788` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Information disclosure - [Discourse: Hidden tag names leaked via category serializers](https://agentprime.io/advisories/CVE-2026-49256.md) `CVE-2026-49256` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Information disclosure - [Discourse: Regular users can route multipart uploads into the admin backup store](https://agentprime.io/advisories/CVE-2026-46413.md) `CVE-2026-46413` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Broken access control - [Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)](https://agentprime.io/advisories/CVE-2026-53961.md) `CVE-2026-53961` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-345 - [Discourse: Remote code execution via pdf uploads](https://agentprime.io/advisories/CVE-2026-55420.md) `CVE-2026-55420` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2026 · Tags: Command injection - [Discourse: Don't leak restricted tag group names via tag info](https://agentprime.io/advisories/CVE-2026-47264.md) `CVE-2026-47264` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [Discourse: Prevent webhook payload disclosure on event redelivery](https://agentprime.io/advisories/CVE-2026-47263.md) `CVE-2026-47263` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [Discourse: Cross-site backup access via path traversal in multisite local backups](https://agentprime.io/advisories/CVE-2026-45775.md) `CVE-2026-45775` · CVE record: discourse discourse · CVSS 6.8 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Path traversal - [Discourse: Chat misauthorization and information disclosure](https://agentprime.io/advisories/CVE-2026-45085.md) `CVE-2026-45085` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure, Broken access control - [Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts](https://agentprime.io/advisories/CVE-2026-44785.md) `CVE-2026-44785` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [Discourse: Non-staff group owners can see email password in plaintext through group history](https://agentprime.io/advisories/CVE-2026-44784.md) `CVE-2026-44784` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts](https://agentprime.io/advisories/CVE-2026-44783.md) `CVE-2026-44783` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control - [Discourse: GroupPostSerializer leaks hidden full names through reaction post association](https://agentprime.io/advisories/CVE-2026-44782.md) `CVE-2026-44782` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [Discourse: Category queue reviewers can read raw incoming emails from queued posts](https://agentprime.io/advisories/CVE-2026-44780.md) `CVE-2026-44780` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [Discourse: Bot debug endpoints disclose whisper translation audit logs](https://agentprime.io/advisories/CVE-2026-44779.md) `CVE-2026-44779` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users](https://agentprime.io/advisories/CVE-2026-44786.md) `CVE-2026-44786` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure - [Discourse has a subscription access bypass in its discourse-subscriptions plugin](https://agentprime.io/advisories/CVE-2026-34154.md) `CVE-2026-34154` · CVE record: discourse discourse · CVSS 2.1 Low · Not analysed yet · Published 19 May 2026 · Tags: Broken access control - [Discourse: Information Disclosure in Form Template API Due to Missing Authorization](https://agentprime.io/advisories/CVE-2026-33514.md) `CVE-2026-33514` · CVE record: discourse discourse · CVSS 6.0 Medium · Not analysed yet · Published 19 May 2026 · Tags: Broken access control - [Discourse: Cached outdated summaries can leak removed content](https://agentprime.io/advisories/CVE-2026-32244.md) `CVE-2026-32244` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, CWE-524, CWE-672 - [Discourse: Staged user custom fields are exposed on public invite pages](https://agentprime.io/advisories/CVE-2026-34947.md) `CVE-2026-34947` · CVE record: discourse discourse · CVSS 2.7 Low · Not analysed yet · Published 3 Apr 2026 · Tags: Information disclosure - [Discourse: Hidden tag visibility bypass on tag routes](https://agentprime.io/advisories/CVE-2026-27481.md) `CVE-2026-27481` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Information disclosure - [Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure](https://agentprime.io/advisories/CVE-2026-33415.md) `CVE-2026-33415` · CVE record: discourse discourse · CVSS 5.1 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Broken access control - [Discourse: Hidden group names and access metadata are exposed to moderators through the \`category-chatables\` endpoint](https://agentprime.io/advisories/CVE-2026-33300.md) `CVE-2026-33300` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Information disclosure Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .