NodeBB

Products

Exploited and recent CVEs

• CVE-2026-120007 Medium 6.5 NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid 0.3%
• CVE-2026-73038 Medium 6.1 NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name 0.2%
• CVE-2026-58593 High 7.5 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User 0.3%
• CVE-2021-47746 High 7.5 NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write 0.7%
• CVE-2023-2850 Medium 4.7 NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted 0.3%
• CVE-2023-26045 Critical 10.0 NodeBB vulnerable to path traversal and code execution via prototype vulnerability 1.0%
• CVE-2022-46164 Critical 9.4 Account takeover via prototype vulnerability 47.4%
• CVE-2022-36076 High 8.8 Account takeover via SSO plugins in NodeBB 0.6%
• CVE-2022-36045 Critical 9.0 Account takeover via cryptographically weak PRNG in NodeBB Forum 1.3%
• CVE-2021-43788 Medium 5.0 Path traversal in translator module of NobeBB 25.8%
• CVE-2021-43786 Critical 9.8 API token verification can be bypassed 2.4%
• CVE-2021-43787 Critical 9.0 XSS via prototype pollution 1.3%
• CVE-2020-15149 Critical 9.9 Account takeover in NodeBB 2.4%