discourse has 9 CVEs on record. Disclosures have slowed: 1 in the last 90 days after 8 in the 90 before. The busiest recent month was March 2026 with 7. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (4) and CWE-200 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 1 prev 8
Worst active — by depth score
CVE-2026-32143Medium· 6.5Discourse is an open-source discussion platform36CVE-2026-32113Medium· 6.1Discourse is an open-source discussion platform34CVE-2026-59830Medium· 5.4Discourse is an open-source discussion platform30CVE-2026-32615Medium· 5.4Discourse is an open-source discussion platform30CVE-2026-32607Medium· 5.4Discourse is an open-source discussion platform30
discourse vulnerabilities
CVEs affecting discourse, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-59830Medium· 5.4Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a cra…
CVE-2026-27481Medium· 5.3Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated o…
CVE-2026-32618Medium· 4.3Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, there is possible channel membership inference from chat user …
CVE-2026-32615Medium· 5.4Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, category group moderators could perform privileged actions on …
CVE-2026-32607Medium· 5.4Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, when the hidden prioritize_full_name_in_ux site setting is ena…
CVE-2026-32273Medium· 5.4Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, updating a category description via API is not sanitizing the …
CVE-2026-32243Medium· 5.4Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations…
CVE-2026-32143Medium· 6.5Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, moderators could export CSV data for admin-restricted reports,…
CVE-2026-32113Medium· 6.1Discourse is an open-source discussion platform
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the enter action in StaticController reads the sso_destination…