# Discourse vulnerabilities Source: https://junglewise.ai/threats/vendors/discourse Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/discourse.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 74 vulnerabilities in Discourse: 0 in the last 7 days and 19 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2017-20290, was published on 22 October 2026. 5 vulnerabilities in the last four weeks, down 50% on the four before (10). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 5 - Last 90 days: 19 - All time: 74 (1 critical, 0 exploited in the wild) ## About Discourse Discourse is an open-source project and company providing modern forum software. ## Latest Discourse vulnerabilities - [CVE-2017-20290: Discourse reflected cross-site scripting in email unsubscribe](https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected) (medium, CVSS 6.1, published 22 Oct 2026) - [CVE-2026-57447: Discourse Doc Categories information disclosure in index refresh](https://junglewise.ai/threats/cve-2026-57447-discourse-doc-categories-is-a-plugin-for-organizing-discourse) (medium, CVSS 4.3, published 16 Oct 2026) - [CVE-2026-55103: Discourse ActivityPub authentication bypass in federated post operations](https://junglewise.ai/threats/cve-2026-55103-discourse-activitypub-adds-activitypub-support-to-discourse-prior) (high, CVSS 8.6, published 15 Oct 2026) - [CVE-2026-91159: Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0) (high, CVSS 7.7, published 14 Oct 2026) - [CVE-2026-91157: Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-91121: Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (medium, CVSS 5, published 24 Sep 2026) - [CVE-2026-91120: Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (medium, CVSS 5.4, published 24 Sep 2026) - [CVE-2026-91119: Discourse stored HTML injection in activity log components](https://junglewise.ai/threats/cve-2026-91119-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (medium, CVSS 6.4, published 24 Sep 2026) - [CVE-2026-91134: Discourse post sanitizer iframe bypass via encoded userinfo](https://junglewise.ai/threats/cve-2026-91134-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (medium, CVSS 5.4, published 24 Sep 2026) - [CVE-2026-91133: Discourse information disclosure in upload path queries](https://junglewise.ai/threats/cve-2026-91133-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-91132: Discourse wildcard iframe origin allowlist bypass](https://junglewise.ai/threats/cve-2026-91132-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (medium, CVSS 4.3, published 24 Sep 2026) - [CVE-2026-91123: Discourse iframe src path traversal via backslash bypass](https://junglewise.ai/threats/cve-2026-91123-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (high, CVSS 7.2, published 24 Sep 2026) - [CVE-2026-91122: Discourse stored XSS in video placeholder component](https://junglewise.ai/threats/cve-2026-91122-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (high, CVSS 8.7, published 24 Sep 2026) - [CVE-2026-84302: Discourse AI access control bypass in private message reviewables](https://junglewise.ai/threats/cve-2026-84302-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-6) (medium, CVSS 4.2, published 24 Sep 2026) - [CVE-2026-59830: Discourse stored XSS via unescaped display name](https://junglewise.ai/threats/cve-2026-59830-discourse-is-an-open-source-discussion-platform-prior-to-2026-7-0) (medium, CVSS 5.4, published 21 Sep 2026) - [CVE-2026-59829: Discourse information disclosure in category group moderation review queue](https://junglewise.ai/threats/cve-2026-59829-discourse-information-disclosure-in-category-group-moderation) (medium, CVSS 4.3, published 17 Aug 2026) - [CVE-2026-55704: Discourse shared-draft information disclosure in group serialization](https://junglewise.ai/threats/cve-2026-55704-discourse-shared-draft-information-disclosure-in-group) (medium, CVSS 4.3, published 17 Aug 2026) - [CVE-2026-55674: Discourse stored XSS via color scheme cookies](https://junglewise.ai/threats/cve-2026-55674-discourse-stored-xss-via-color-scheme-cookies) (critical, CVSS 9.3, published 17 Aug 2026) - [CVE-2026-53960: Discourse hidden first-post content leakage in Q&A JSON-LD schema](https://junglewise.ai/threats/cve-2026-53960-discourse-hidden-first-post-content-leakage-in-q-a-json-ld-schema) (medium, CVSS 5.3, published 17 Aug 2026) - [CVE-2026-72732: Discourse Templates endpoint information disclosure via tag filtering bypass](https://junglewise.ai/threats/cve-2026-72732-discourse-templates-endpoint-information-disclosure-via-tag) (medium, CVSS 4.3, published 10 Aug 2026) - [CVE-2026-72731: Discourse SQL injection in Data Explorer parameterized queries](https://junglewise.ai/threats/cve-2026-72731-discourse-sql-injection-in-data-explorer-parameterized-queries) (high, CVSS 7.1, published 10 Aug 2026) - [CVE-2026-72730: Discourse stored XSS in Rich Text Editor chat transcript username](https://junglewise.ai/threats/cve-2026-72730-discourse-stored-xss-in-rich-text-editor-chat-transcript-username) (high, CVSS 8.7, published 10 Aug 2026) - [CVE-2026-72729: Discourse discourse-local-dates HTML injection](https://junglewise.ai/threats/cve-2026-72729-discourse-discourse-local-dates-html-injection) (info, published 10 Aug 2026) - [CVE-2026-72728: Discourse Onebox allowlist bypass](https://junglewise.ai/threats/cve-2026-72728-discourse-onebox-allowlist-bypass) (medium, CVSS 6.3, published 10 Aug 2026) - [CVE-2026-72727: Discourse stored XSS in moderation review queue](https://junglewise.ai/threats/cve-2026-72727-discourse-stored-xss-in-moderation-review-queue) (info, CVSS 4.8, published 10 Aug 2026) ## Most severe Discourse vulnerabilities - [CVE-2026-55674: Discourse stored XSS via color scheme cookies](https://junglewise.ai/threats/cve-2026-55674-discourse-stored-xss-via-color-scheme-cookies) (critical, CVSS 9.3, published 17 Aug 2026) - [CVE-2026-72730: Discourse stored XSS in Rich Text Editor chat transcript username](https://junglewise.ai/threats/cve-2026-72730-discourse-stored-xss-in-rich-text-editor-chat-transcript-username) (high, CVSS 8.7, published 10 Aug 2026) - [CVE-2026-91122: Discourse stored XSS in video placeholder component](https://junglewise.ai/threats/cve-2026-91122-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8) (high, CVSS 8.7, published 24 Sep 2026) - [CVE-2026-55103: Discourse ActivityPub authentication bypass in federated post operations](https://junglewise.ai/threats/cve-2026-55103-discourse-activitypub-adds-activitypub-support-to-discourse-prior) (high, CVSS 8.6, published 15 Oct 2026) - [CVE-2026-44787: Discourse privilege escalation in signup flow](https://junglewise.ai/threats/cve-2026-44787-discourse-privilege-escalation-in-signup-flow) (high, CVSS 8.2, published 9 Jul 2026) - [CVE-2026-91159: Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0) (high, CVSS 7.7, published 14 Oct 2026) - [CVE-2026-91157: Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-44786: Discourse information disclosure in public chat channels](https://junglewise.ai/threats/cve-2026-44786-discourse-information-disclosure-in-public-chat-channels) (high, CVSS 7.5, published 12 Jun 2026) - [CVE-2026-55420: Discourse RCE via PDF upload processing](https://junglewise.ai/threats/cve-2026-55420-discourse-rce-via-pdf-upload-processing) (high, CVSS 7.5, published 9 Jul 2026) - [CVE-2026-53963: Discourse stored XSS in 2FA delete confirmation dialog](https://junglewise.ai/threats/cve-2026-53963-discourse-stored-xss-in-2fa-delete-confirmation-dialog) (high, CVSS 7.3, published 9 Jul 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, down 50% on the four before (10). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 4 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 10 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Discourse technologies - [Discourse](https://junglewise.ai/threats/technologies/discourse): 72 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Discourse vulnerabilities", https://junglewise.ai/threats/vendors/discourse, 9 November 2026.