Discourse

www.discourse.org ↗ Bug Bounty ↗
C
CAUTION
173
Total CVEs
21
Crit / High
78
Medium
8%
Unpatched
40%
Patched
5.5
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →
// INTEL UPGRADE
Full Company Dossier — Coming Soon
Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.
OSINT FINANCIALS EXEC PROFILES BREACH DB
▸ CVE Trend by Year
▸ Patch Coverage
Patched
40%
Unpatched
8%
Under Review
52%
✓ 51 patched ✗ 10 unpatched ~ 65 under review
▸ Intelligence by Audience
PoC Available
7 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"discourse" port:443
org:"Discourse" http.status:200
Top EPSS (Exploitation Probability)
CVE-2026-72721 0.43% exploitation probability
CVE-2026-72723 0.39% exploitation probability
CVE-2026-55674 0.38% exploitation probability
CVE-2026-72724 0.32% exploitation probability
CVE-2026-72722 0.32% exploitation probability
🎯 Bug Bounty Program: https://github.com/discourse/discourse/security/policy
Quick Facts for Reporting
Total CVEs tracked
173
Critical severity
2
Actively exploited (CISA)
0
Unpatched ratio
8%
Avg CVSS score
5.5
Security grade
C (CAUTION)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Security Risk Score (for investors)
MED
Vuln Volume
GOOD
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
▸ Security News Google News
Discourse Vulnerabilities Allow Hackers to Execute JavaScript and Read Server Files - Cyber Press
Cyber Press 1d ago
Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read - CyberSecurityNews
CyberSecurityNews 1d ago
Cybersecurity researchers gain access to OpenAI’s GitHub repository using Claude - SiliconANGLE
SiliconANGLE 2026-09-18
Researchers used Anthropic’s Claude to hack into OpenAI - TechCrunch
TechCrunch 2026-09-18
Hackers breached OpenAI, adding to fever pitch of security and safety concerns - NBC News
NBC News 2026-09-18
Trump to assert voting machine vulnerabilities in Thursday speech - Reuters
Reuters 2026-07-14
▸ Recent CVEs showing 20 of 126
CVE IDSeverityPatchEPSSDate
CVE-2026-91120 5.4 MEDIUM PATCH UNDER REVIEW 0.20% 2026-09-24
CVE-2026-91123 7.2 HIGH PATCH UNDER REVIEW 0.29% 2026-09-24
CVE-2026-91132 4.3 MEDIUM PATCH UNDER REVIEW 0.14% 2026-09-24
CVE-2026-91122 8.7 HIGH PATCH UNDER REVIEW 0.26% 2026-09-24
CVE-2026-84302 4.2 MEDIUM PATCH UNDER REVIEW 0.24% 2026-09-24
CVE-2026-91134 5.4 MEDIUM PATCH UNDER REVIEW 0.22% 2026-09-24
CVE-2026-91121 5.0 MEDIUM PATCH UNDER REVIEW 0.26% 2026-09-24
CVE-2026-91119 PoC 6.4 MEDIUM PATCH UNDER REVIEW 0.20% 2026-09-24
CVE-2026-91133 6.5 MEDIUM PATCH UNDER REVIEW 0.29% 2026-09-24
CVE-2026-59830 5.4 MEDIUM PATCH UNDER REVIEW 0.17% 2026-09-21
CVE-2026-55674 PoC 9.3 CRITICAL PATCH UNDER REVIEW 0.38% 2026-08-17
CVE-2026-59829 4.3 MEDIUM PATCH UNDER REVIEW 0.23% 2026-08-17
CVE-2026-55704 PoC 4.3 MEDIUM PATCH UNDER REVIEW 0.17% 2026-08-17
CVE-2026-72723 5.3 MEDIUM PATCH UNDER REVIEW 0.39% 2026-08-10
CVE-2026-72724 PoC 4.3 MEDIUM PATCH UNDER REVIEW 0.32% 2026-08-10
CVE-2026-72720 6.4 MEDIUM PATCH UNDER REVIEW 0.30% 2026-08-10
CVE-2026-72732 PoC 4.3 MEDIUM PATCH UNDER REVIEW 0.25% 2026-08-10
CVE-2026-72722 PoC 4.3 MEDIUM PATCH UNDER REVIEW 0.32% 2026-08-10
CVE-2026-72721 PoC 5.3 MEDIUM PATCH UNDER REVIEW 0.43% 2026-08-10
CVE-2026-72731 7.1 HIGH PATCH UNDER REVIEW 0.23% 2026-08-10
View all 126 CVEs for Discourse →
▸Intel
HQSan Francisco, California, USA
Founded2013
CEOJeff Atwood
Bug BountyView Program ↗
Trust ScoreC — CAUTION
Max CVSS9.1
Last Updated2026-08-03
▸Top Weaknesses
CWE-200
Sensitive Information Exposure
34 occurrences in Discourse CVEs (20% of total)
CWE-200 ⓘ
34
CWE-79
Cross-Site Scripting (XSS)
26 occurrences in Discourse CVEs (15% of total)
CWE-79 ⓘ
26
CWE-862
Unknown Weakness Type
23 occurrences in Discourse CVEs (13% of total)
CWE-862 ⓘ
23
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Unknown Weakness Type
15 occurrences in Discourse CVEs (9% of total)
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) ⓘ
15
CWE-284
Improper Access Control
9 occurrences in Discourse CVEs (5% of total)
CWE-284 ⓘ
9
CWE-770
Unknown Weakness Type
7 occurrences in Discourse CVEs (4% of total)
CWE-770 ⓘ
7
CWE-862 (Missing Authorization)
Unknown Weakness Type
5 occurrences in Discourse CVEs (3% of total)
CWE-862 (Missing Authorization) ⓘ
5
CWE-639
Unknown Weakness Type
5 occurrences in Discourse CVEs (3% of total)
CWE-639 ⓘ
5
▸Company Profile

Discourse is an open-source discussion platform provider known for its modern forum software used by communities, enterprises, and governments. Its platform emphasizes security with features like encryption, spam filtering, and regular security updates, making it a significant target for vulnerability research with 146 tracked CVEs.

▸Response Metrics
Est. MTTR ⓘ ~138 days (Poor)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ ↗ +279% worse
CVE count 2026 vs 2025:  28 → 106 CVEs
Patch Speed ⓘ Poor (>65% open)
8% of CVEs still unpatched.  Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
▸ Financial Risk Estimate
Est. GDPR Low
€540K
Est. GDPR High
€5.4M

Based on 2 critical CVEs, 0 CISA KEV, 87% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions
⚖ Compare with another vendor
▸Embed Badge
Discourse C valtersit.com