D
Vendor security profile
discourse
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs61
Critical2
CISA KEV0
Public exploit0
Patch rate%44
Avg. CVSS5.7
12-month vulnerability rate
0
0
0
0
15
2
3
0
11
17
10
3
CVE KEV
CVE severity distribution
61toplam CVE
Critical2 (3%)
High11 (18%)
Medium46 (75%)
Low2 (3%)
Patch and exploitation view
%44
Verified patch
%0
CISA KEV
%0
Public exploit
27Patch available
0Partial
0Workaround
0Vendor: no patch
34Unknown
Latest vulnerabilities
7.5
CVE-2026-91157
Discourse: Media uploads remain publicly accessible after category permissions are restricted
D
Patch status unknown
7.5
CVE-2026-91156
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
D
Patch status unknown
7.7
CVE-2026-91159
Discourse: Stored oEmbed HTML injection via allowed iframe
D
Patch status unknown
6.4
CVE-2026-91119
Discourse: Encode action_code_who in mention URLs
D
Patch status unknownEPSS %0
5.0
CVE-2026-91121
Discourse: Chat upload filenames rendered as raw HTML in excerpts
D
Patch status unknownEPSS %0
5.4
CVE-2026-91120
Discourse: Stored HTML injection in video notification emails
D
Patch status unknownEPSS %0
4.3
CVE-2026-91132
Discourse: Wildcard iframe origin allowlist bypass via authority separators
D
Patch status unknownEPSS %0
8.7
CVE-2026-91122
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
D
Patch status unknownEPSS %0
7.2
CVE-2026-91123
Discourse: Reject literal backslash path separators in iframe src traversal guard
D
Patch status unknownEPSS %0
6.5
CVE-2026-91133
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
D
Patch status unknownEPSS %0