Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how discourse compares to other vendors in security performance

View Risk Score →

Discourse DiscourseDiscourse: Templates endpoint exposes hidden tag names

Risk 22
Severity
4.3
First published (updated )
CVE-2026-72732

Discourse DiscourseDiscourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer

Risk 48
Severity
7.1
First published (updated )
CVE-2026-72731

Discourse DiscourseDiscourse: Stored XSS chat-transcript username unescaped in Rich Text Editor

Risk 61
Severity
8.7
First published (updated )
CVE-2026-72730

Discourse discourse-local-dates pluginDiscourse: Stored XSS in discourse-local-dates plugin

Risk 22
Severity
2
First published (updated )
CVE-2026-72729

Discourse DiscourseDiscourse: Onebox iframe origin allowlist enforces URL authority boundary

Risk 46
Severity
6.3
First published (updated )
CVE-2026-72728
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Discourse DiscourseDiscourse: Stored XSS in the moderation review queue

Risk 32
Severity
4.8
First published (updated )
CVE-2026-72727

Discourse DiscourseDiscourse: Unauthorized eavesdropping on private AI bot conversations.

Risk 38
Severity
6.5
First published (updated )
CVE-2026-72726

Discourse DiscourseDiscourse: Stored XSS in staff action logs injects staff UI

Risk 34
Severity
5.4
First published (updated )
CVE-2026-72725

Discourse DiscourseDiscourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags

Risk 27
Severity
5.3
First published (updated )
CVE-2026-72723

Discourse DiscourseDiscourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs

Risk 22
Severity
4.3
First published (updated )
CVE-2026-72722
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Discourse PrettyText.format_for_emailDiscourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Risk 39
Severity
6.4
First published (updated )
CVE-2026-72720

Discourse DiscourseDiscourse: Private event sample invitees are serialized to non-invited event viewers

Risk 27
Severity
5.3
First published (updated )
CVE-2026-45780

Discourse DiscourseDiscourse: Stored-XSS in 2FA delete confirmation modal

Risk 74
Severity
9
First published (updated )
CVE-2026-53963

Discourse DiscourseDiscourse: Hidden post revisions leak through adjacent visible diffs

Risk 27
Severity
5.3
First published (updated )
CVE-2026-59828

Discourse DiscourseDiscourse: Signup-time primary_group_id assignment grants whisperer access

Risk 54
Severity
8.2
First published (updated )
CVE-2026-44787
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Discourse DiscourseDiscourse: Insufficient SVG sanitization logic

Risk 34
Severity
5.4
First published (updated )
CVE-2026-53962

Discourse DiscourseDiscourse: Topic featured link susceptible to stored XSS

Risk 52
Severity
7.4
First published (updated )
CVE-2026-55424

Discourse DiscourseDiscourse: Secure uploads exposed by hotlinked image copying

Risk 43
Severity
6.3
First published (updated )
CVE-2026-45788

Discourse DiscourseDiscourse: Hidden tag names leaked via category serializers

Risk 43
Severity
6.3
First published (updated )
CVE-2026-49256

Discourse DiscourseDiscourse: Regular users can route multipart uploads into the admin backup store

Risk 38
Severity
6.5
First published (updated )
CVE-2026-46413
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Discourse DiscourseDiscourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)

Risk 40
Severity
6.5
First published (updated )
CVE-2026-53961

Discourse DiscourseDiscourse: Remote code execution via pdf uploads

Risk 75
Severity
8.1
First published (updated )
CVE-2026-55420

Discourse DiscourseDiscourse: Don't leak restricted tag group names via tag info

Risk 27
Severity
5.3
First published (updated )
CVE-2026-47264

Discourse DiscourseDiscourse: Prevent webhook payload disclosure on event redelivery

Risk 22
Severity
4.3
First published (updated )
CVE-2026-47263

Discourse DiscourseDiscourse: Cross-site backup access via path traversal in multisite local backups

Risk 37
Severity
6.8
First published (updated )
CVE-2026-45775
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Discourse DiscourseDiscourse: Chat misauthorization and information disclosure

Risk 27
Severity
5.3
First published (updated )
CVE-2026-45085

Discourse DiscourseDiscourse: Hidden reply-to post raw can be disclosed through AI explain prompts

Risk 22
Severity
4.3
First published (updated )
CVE-2026-44785

Discourse DiscourseDiscourse: Non-staff group owners can see email password in plaintext through group history

Risk 38
Severity
6.5
First published (updated )
CVE-2026-44784

Discourse DiscourseDiscourse: Replying to a whisper lets non-whisperers create staff-only whisper posts

Risk 34
Severity
5.4
First published (updated )
CVE-2026-44783

Discourse DiscourseDiscourse: GroupPostSerializer leaks hidden full names through reaction post association

Risk 22
Severity
4.3
First published (updated )
CVE-2026-44782
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203