# discourse. Every CVE that names discourse among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [DIscourse's discourse-policy plugin lacks post access check](https://agentprime.io/advisories/CVE-2026-26207.md) `CVE-2026-26207` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Broken access control - [Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint](https://agentprime.io/advisories/CVE-2026-26078.md) `CVE-2026-26078` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 26 Feb 2026 · Tags: Broken access control - [Discourse doesn't ensure webhooks require a token](https://agentprime.io/advisories/CVE-2026-26077.md) `CVE-2026-26077` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Authentication bypass - [Discourse staff action logs expose sensitive information to moderators](https://agentprime.io/advisories/CVE-2026-24742.md) `CVE-2026-24742` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control - [Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized users](https://agentprime.io/advisories/CVE-2026-23743.md) `CVE-2026-23743` · CVE record: discourse discourse · CVSS 6.9 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Information disclosure - [Discourse topic conversion permission vulnerability for moderators](https://agentprime.io/advisories/CVE-2026-21865.md) `CVE-2026-21865` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control - [Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change](https://agentprime.io/advisories/CVE-2025-69289.md) `CVE-2025-69289` · CVE record: discourse discourse · CVSS 5.1 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control - [Discourse moderators can access admin-only reports exposing private upload URLs](https://agentprime.io/advisories/CVE-2025-69218.md) `CVE-2025-69218` · CVE record: discourse discourse · CVSS 7.1 High · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control - [Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint](https://agentprime.io/advisories/CVE-2025-68934.md) `CVE-2025-68934` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Denial of service - [Discourse non-admin moderators can exfiltrate private content via post ownership transfer](https://agentprime.io/advisories/CVE-2025-68933.md) `CVE-2025-68933` · CVE record: discourse discourse · CVSS 6.9 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control - [Discourse users archives leaked to users with moderation privileges](https://agentprime.io/advisories/CVE-2025-68666.md) `CVE-2025-68666` · CVE record: discourse discourse · CVSS 5.9 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control - [FinalDestination hostname matching allows SSRF protection bypass](https://agentprime.io/advisories/CVE-2025-68662.md) `CVE-2025-68662` · CVE record: discourse discourse · CVSS 7.6 High · Not analysed yet · Published 28 Jan 2026 · Tags: Server-side request forgery (SSRF) - [Discourse AI Discover's continue conversation allows threat actor to impersonate user](https://agentprime.io/advisories/CVE-2025-68660.md) `CVE-2025-68660` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control - [Discourse has DoS vulnerability in username change endpoint](https://agentprime.io/advisories/CVE-2025-68659.md) `CVE-2025-68659` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Denial of service - [Discourse subscriptions are susceptible to takeover](https://agentprime.io/advisories/CVE-2025-68479.md) `CVE-2025-68479` · CVE record: discourse discourse · CVSS 7.1 High · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control - [Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin](https://agentprime.io/advisories/CVE-2025-67723.md) `CVE-2025-67723` · CVE record: discourse discourse · CVSS 4.6 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Cross-site scripting (XSS) - [Discourse allows script execution in uploaded HTML/XML files on S3](https://agentprime.io/advisories/CVE-2025-66488.md) `CVE-2025-66488` · CVE record: discourse discourse · CVSS 4.6 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-116 - [Users are able to find users by name even when \`enable_names\` is off](https://agentprime.io/advisories/CVE-2025-64528.md) `CVE-2025-64528` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: CWE-202 - [Discourse is missing Cache-Control response header on error responses](https://agentprime.io/advisories/CVE-2025-61598.md) `CVE-2025-61598` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2025 · Tags: CWE-524 - [Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments](https://agentprime.io/advisories/CVE-2025-59337.md) `CVE-2025-59337` · CVE record: discourse discourse · CVSS 5.5 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Command injection - [Discourse AI Suggestions Contain Insecure Direct Object Reference](https://agentprime.io/advisories/CVE-2025-58055.md) `CVE-2025-58055` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Broken access control - [Discourse is vulnerable to XSS when quoting chat messages](https://agentprime.io/advisories/CVE-2025-58054.md) `CVE-2025-58054` · CVE record: discourse discourse · CVSS 3.5 Low · Not analysed yet · Published 1 Oct 2025 · Tags: Cross-site scripting (XSS) - [Discourse welcome banner user name XSS](https://agentprime.io/advisories/CVE-2025-54411.md) `CVE-2025-54411` · CVE record: discourse discourse · CVSS 2.4 Low · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS) - [Discourse's WebAuthn challenge isn't cleared from user session after authentication](https://agentprime.io/advisories/CVE-2025-53102.md) `CVE-2025-53102` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2025 · Tags: Authentication bypass - [Discourse users are able to see their own whispers even after being removed from a group that has been configured to see whispers](https://agentprime.io/advisories/CVE-2025-49845.md) `CVE-2025-49845` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Information disclosure - [Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow](https://agentprime.io/advisories/CVE-2025-48954.md) `CVE-2025-48954` · CVE record: discourse discourse · CVSS 8.1 High · Not analysed yet · Published 25 Jun 2025 · Tags: Cross-site scripting (XSS) - [Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe](https://agentprime.io/advisories/CVE-2025-48877.md) `CVE-2025-48877` · CVE record: discourse discourse · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: CWE-1038 - [Discourse vulnerable to HTML injection when inviting to topic via email](https://agentprime.io/advisories/CVE-2025-48062.md) `CVE-2025-48062` · CVE record: discourse discourse · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: Cross-site scripting (XSS), CWE-116 - [Discourse vulnerable to DoS via large URL payload in PM to a bot](https://agentprime.io/advisories/CVE-2025-48053.md) `CVE-2025-48053` · CVE record: discourse discourse · CVSS 8.7 High · Not analysed yet · Published 9 Jun 2025 · Tags: Denial of service - [Private data leak on login-required Discourse sites](https://agentprime.io/advisories/CVE-2025-46813.md) `CVE-2025-46813` · CVE record: discourse discourse · CVSS 5.8 Medium · Not analysed yet · Published 5 May 2025 · Tags: Information disclosure - [Discourse DM limits aren’t always properly enforced](https://agentprime.io/advisories/CVE-2025-32376.md) `CVE-2025-32376` · CVE record: discourse discourse · CVSS 4.8 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: Broken access control - [Discourse may bypass user preference when adding users to chat groups](https://agentprime.io/advisories/CVE-2025-24972.md) `CVE-2025-24972` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: Broken access control - [Discourse has race condition when adding users to a group DM](https://agentprime.io/advisories/CVE-2025-24808.md) `CVE-2025-24808` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: Race condition - [Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse](https://agentprime.io/advisories/CVE-2024-53266.md) `CVE-2024-53266` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: Cross-site scripting (XSS) - [Partial denial of service via inline oneboxes in Discourse](https://agentprime.io/advisories/CVE-2024-53851.md) `CVE-2024-53851` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: Denial of service - [Potential bypass of chat permissions in Discourse](https://agentprime.io/advisories/CVE-2024-53994.md) `CVE-2024-53994` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: CWE-281 - [Anonymous cache poisoning via XHR requests in Discourse](https://agentprime.io/advisories/CVE-2024-55948.md) `CVE-2024-55948` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 4 Feb 2025 · Tags: CWE-346 - [Users can see other user's tagged PMs in Discourse](https://agentprime.io/advisories/CVE-2024-56197.md) `CVE-2024-56197` · CVE record: discourse discourse · CVSS 2.2 Low · Not analysed yet · Published 4 Feb 2025 · Tags: Information disclosure - [HTMLi(XSS without CSP) via Onebox urls in Discourse](https://agentprime.io/advisories/CVE-2024-56328.md) `CVE-2024-56328` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: Cross-site scripting (XSS) - [Client Side Path Traversal using activate account route in Discourse](https://agentprime.io/advisories/CVE-2025-22601.md) `CVE-2025-22601` · CVE record: discourse discourse · CVSS 3.1 Low · Not analysed yet · Published 4 Feb 2025 · Tags: Path traversal - [Stored DOM-based XSS (without CSP) via video placeholders in Discourse](https://agentprime.io/advisories/CVE-2025-22602.md) `CVE-2025-22602` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: Cross-site scripting (XSS) - [Anonymous cache poisoning via request headers in Discourse](https://agentprime.io/advisories/CVE-2025-23023.md) `CVE-2025-23023` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 4 Feb 2025 · Tags: CWE-346 - [Bypass of Discourse Connect using other login paths if enabled in Discourse](https://agentprime.io/advisories/CVE-2024-49765.md) `CVE-2024-49765` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: Information disclosure - [Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse](https://agentprime.io/advisories/CVE-2024-52589.md) `CVE-2024-52589` · CVE record: discourse discourse · CVSS 2.2 Low · Not analysed yet · Published 19 Dec 2024 · Tags: Information disclosure - [Magnific lightbox susceptible to Cross-site Scripting in Discourse](https://agentprime.io/advisories/CVE-2024-52794.md) `CVE-2024-52794` · CVE record: discourse discourse · CVSS 6.8 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: Cross-site scripting (XSS) - [Potential Backup file leaked via Nginx in Discourse](https://agentprime.io/advisories/CVE-2024-53991.md) `CVE-2024-53991` · CVE record: discourse discourse · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.30 · Not analysed yet · Published 19 Dec 2024 · Tags: Information disclosure - [Anonymous cache poisoning via XHR requests in Discourse](https://agentprime.io/advisories/CVE-2024-47773.md) `CVE-2024-47773` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-610 - [Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse](https://agentprime.io/advisories/CVE-2024-47772.md) `CVE-2024-47772` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2024 · Tags: Cross-site scripting (XSS) - [Denial of service by the absence of restrictions on replies to posts in Discourse](https://agentprime.io/advisories/CVE-2024-43789.md) `CVE-2024-43789` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2024 · Tags: Denial of service - [Prevent topic list filtering by hidden tags for unauthorized users in Discourse](https://agentprime.io/advisories/CVE-2024-45297.md) `CVE-2024-45297` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2024 · Tags: Privilege escalation - [Bypass of email address validation via encoded email addresses in Discourse](https://agentprime.io/advisories/CVE-2024-45051.md) `CVE-2024-45051` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 7 Oct 2024 · Tags: Authentication bypass - [Discourse allows iframe injection though default site setting](https://agentprime.io/advisories/CVE-2024-39320.md) `CVE-2024-39320` · CVE record: discourse discourse · CVSS 6.1 Medium · Not analysed yet · Published 30 Jul 2024 · Tags: Other injection, CWE-1021 - [Discourse vulnerable to DoS via Tag Group](https://agentprime.io/advisories/CVE-2024-37299.md) `CVE-2024-37299` · CVE record: discourse discourse · CVSS 4.9 Medium · Not analysed yet · Published 30 Jul 2024 · Tags: Denial of service - [Discourse has an XSS via Onebox system](https://agentprime.io/advisories/CVE-2024-37165.md) `CVE-2024-37165` · CVE record: discourse discourse · CVSS 6.3 Medium · Not analysed yet · Published 30 Jul 2024 · Tags: Cross-site scripting (XSS) - [Denial of service via Watched Words in Discourse](https://agentprime.io/advisories/CVE-2024-38360.md) `CVE-2024-38360` · CVE record: discourse discourse · CVSS 4.9 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: Denial of service - [Discourse vulnerable to Server-Side Request Forgery via FastImage](https://agentprime.io/advisories/CVE-2024-37157.md) `CVE-2024-37157` · CVE record: discourse discourse · CVSS 6.4 Medium · Not analysed yet · Published 3 Jul 2024 · Tags: Server-side request forgery (SSRF) - [Discourse doesn't limit reviewable user serializer payload](https://agentprime.io/advisories/CVE-2024-36122.md) `CVE-2024-36122` · CVE record: discourse discourse · CVSS 2.4 Low · Not analysed yet · Published 3 Jul 2024 · Tags: Information disclosure - [Discourse missing authorization checks for suspending admins/moderators](https://agentprime.io/advisories/CVE-2024-36113.md) `CVE-2024-36113` · CVE record: discourse discourse · CVSS 4.9 Medium · Not analysed yet · Published 3 Jul 2024 · Tags: Broken access control - [Discourse vulnerable to stored-dom XSS via Facebook Oneboxes](https://agentprime.io/advisories/CVE-2024-35234.md) `CVE-2024-35234` · CVE record: discourse discourse · CVSS 4.2 Medium · Not analysed yet · Published 3 Jul 2024 · Tags: Cross-site scripting (XSS) - [Discourse vulnerable to DoS through Onebox](https://agentprime.io/advisories/CVE-2024-35227.md) `CVE-2024-35227` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2024 · Tags: CWE-20 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .