Discourse ↗
Summary iPlain-English security verdict for Discourse, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.
Discourse currently scores 100/100 — healthy. No tracked vulnerabilities are currently known to be exploited in the wild. The latest supported release is 2026.9.0. It's on the latest patch with no significant known issues — keep it current.
Disclosure trend iNew CVEs published for Discourse each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.
Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.
Most urgent first — actively exploited, then likeliest to be exploited.
CVE-2021-41163 CRITICAL Injection EPSS 20% → fixed in 2.7.9 CVE-2022-36066 CRITICAL Unrestricted file upload EPSS 2% → fixed in 2.8.9 CVE-2025-53102 CRITICAL CWE-384 EPSS 0% → fixed in 3.4.6 CVE-2025-48877 CRITICAL CWE-1038 EPSS 0% → fixed in 3.5.0Get alerted about Discourse
Be emailed the moment Discourse gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.
We email only on real events for Discourse — no marketing, no sharing, and we never know what you run. Track your whole stack →
Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.
How long each Discourse release line is supported — and when it sunsets. Select a line for its full report.
Full Discourse end-of-life dates & support timeline →
2026.9 latest 2026.9.0 Supported until 2026-11-242026.9.0 → 2026.8 latest 2026.8.1 Supported until 2026-10-272026.8.1 → 2026.7 latest 2026.7.3 Supported until 2027-03-302026.7.3 → 2026.6 latest 2026.6.3 End of life ended 2026-08-252026.6.3 → 2026.5 latest 2026.5.2 End of life ended 2026-07-282026.5.2 → 2026.4 latest 2026.4.2 End of life ended 2026-06-302026.4.2 → 2026.3 latest 2026.3.1 End of life ended 2026-05-282026.3.1 → 2026.2 latest 2026.2.2 End of life ended 2026-04-282026.2.2 → 2026.1 latest 2026.1.9 End of life ended 2026-09-222026.1.9 → 2025.12 latest 2025.12.2 End of life ended 2026-02-262025.12.2 → See all upcoming end-of-life dates →Frequently asked
Is Discourse safe and patched?
Discourse currently scores 100/100 — healthy. No tracked vulnerabilities are currently known to be exploited in the wild. The latest supported release is 2026.9.0. It's on the latest patch with no significant known issues — keep it current.
What should I do about Discourse now?
Upgrade Discourse to the latest supported release (2026.9.0) or later and apply available security updates, then confirm against Discourse's official advisory.
When does Discourse reach end-of-life?
The latest supported Discourse release is 2026.9.0. After end-of-life a release no longer receives security patches.
Which versions of Discourse are still receiving security updates?
Supported Discourse release lines (latest 2026.9.0): 2026.9, 2026.8, 2026.7. End-of-life releases no longer receive security patches.
Similar software we track
Other Collaboration products — compare their security status.
Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Discourse's official advisory before you patch or upgrade — Discourse official site ↗