Discord has 2 CVEs on record. 1 was published in the last 90 days. The median CVSS is 6.8 (medium), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
2
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-104480Critical· 9.4Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant52CVE-2026-24332Medium· 4.3Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": …36
Discord vulnerabilities
CVEs affecting Discord, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-104480Critical· 9.4Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position abl…
▾ MidnightDiscord · discord/libdaveEPSS 0.40%via NVD
CVE-2026-24332Medium· 4.3PoCDiscord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": …
Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": …
▾ TwilightDiscord · WebSocket API serviceEPSS 0.29%via CVEORG