Log in Start free

nocobase

Products

ProductCVEsExploitedLatest
nocobase10–Oct 19, 2026
@nocobase/plugin-workflow-request1–Apr 17, 2026
plugin-workflow-javascript1–Apr 13, 2026

Exploited and recent CVEs

  • CVE-2026-112306 High 7.2 NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields 0.3%
  • CVE-2026-84701 Medium 5.4 NocoBase Rich Text Field Stored Cross-Site Scripting via API 0.3%
  • CVE-2026-55410 Medium 6.7 NocoBase backup restore schema name allows command injection 0.7%
  • CVE-2026-52887 Critical 10.0 NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE 0.9%
  • CVE-2026-52888 Medium 6.8 NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass 0.5%
  • CVE-2026-58468 Medium 5.5 NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper 0.3%
  • CVE-2026-41641 High 7.2 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call 1.8%
  • CVE-2026-41640 High 7.5 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading 1.9%
  • CVE-2026-40346 Medium 6.4 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins 0.4%
  • CVE-2026-6224 High 7.3 nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox 0.3%
  • CVE-2026-34825 High 8.5 NocoBase Has SQL Injection via template variable substitution in workflow SQL node 0.4%
  • CVE-2026-34156 Critical 10.0 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node 35.0%