Nodebb vulnerabilities

Products

• Nodebb 22

Newest

• nodebb NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid CVE-2026-120007 6.9 MediumOctober 30, 2026
• nodebb NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name CVE-2026-73038 5.3 MediumAugust 13, 2026
• nodebb NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVE-2026-58593 8.7 HighJuly 1, 2026
• nodebb plugin emoji NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write CVE-2021-47746 8.6 HighJanuary 21, 2026
• nodebb NodeBB SQL Injection vulnerability CVE-2025-50979 EPSS 10.6% 8.6 HighAugust 27, 2025
• nodebb Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to... CVE-2025-29513 EPSS 42.8% 6.1 MediumApril 18, 2025
• nodebb Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to... CVE-2025-29512 6.1 MediumApril 18, 2025
• nodebb NodeBB Cross-site scripting (XSS) vulnerability CVE-2024-57041 Fix available EPSS 40.1% 4.6 MediumJanuary 24, 2025
• nodebb Incorrect Access Control in NodeBB CVE-2024-29316 Fix available 6.3 MediumMarch 28, 2024
• nodebb NodeBB Pre-Authentication Denial-of-Service CVE-2023-30591 EPSS 58.7% 7.5 HighSeptember 29, 2023
• nodebb A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum... CVE-2023-43187 EPSS 47.4% 9.8 CriticalSeptember 26, 2023
• nodebb Unintentional leakage of private information via cross-origin websocket session hijacking CVE-2023-2850 Fix available 4.7 MediumJuly 25, 2023
• nodebb NodeBB vulnerable to path traversal and code execution via prototype vulnerability CVE-2023-26045 Fix available 10.0 CriticalJuly 24, 2023
• nodebb Account takeover via prototype vulnerability CVE-2022-46164 Public exploitFix available EPSS 47.4% 9.4 CriticalDecember 5, 2022
• nodebb NodeBB abort cross-site request forgery CVE-2022-3978 Fix available 4.3 MediumNovember 13, 2022
• nodebb Account takeover via SSO plugins in NodeBB CVE-2022-36076 Fix available 8.8 HighSeptember 2, 2022
• nodebb Account takeover via cryptographically weak PRNG in NodeBB Forum CVE-2022-36045 Fix available 9.0 CriticalAugust 30, 2022
• nodebb Path traversal in translator module of NobeBB CVE-2021-43788 Fix available EPSS 25.8% 5.0 MediumNovember 29, 2021
• nodebb API token verification can be bypassed CVE-2021-43786 Fix available 9.8 CriticalNovember 29, 2021
• nodebb XSS via prototype pollution CVE-2021-43787 Fix available 9.0 CriticalNovember 29, 2021
• psychobunny nodebb-plugin-blog-comments, nodebb blog comments +1 more XSS due to lack of CSRF validation for replying/publishing CVE-2020-15156 Fix available 6.8 MediumAugust 26, 2020
• nodebb Account takeover in NodeBB CVE-2020-15149 9.9 CriticalAugust 19, 2020
• nodebb Cross-site Scripting in NodeBB CVE-2015-9286 Fix available 6.1 MediumApril 30, 2019
• nodebb NodeBB Cross-site Scripting Vulnerability in Markdown Processing CVE-2015-3296 Fix available 6.1 MediumSeptember 21, 2017