Nodebb

This hub aggregates every CVE we track for Nodebb, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Nodebb.

• CVE-2026-58593NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User7.5Jul 1, 2026
• CVE-2025-50979NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remot...8.6Aug 27, 2025
• CVE-2025-29513Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.6.1Apr 18, 2025
• CVE-2025-29512Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is ...6.1Apr 18, 2025
• CVE-2024-57041A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.4.6Jan 24, 2025
• CVE-2024-29316NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.6.3Mar 28, 2024
• CVE-2023-30591NodeBB Pre-Authentication Denial-of-Service7.5Sep 29, 2023
• CVE-2023-43187A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.9.8Sep 26, 2023
• CVE-2023-2850NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extrac...4.7Jul 25, 2023
• CVE-2023-26045NodeBB vulnerable to path traversal and code execution via prototype vulnerability10.0Jul 24, 2023
• CVE-2022-46164Account takeover via prototype vulnerability9.4Dec 5, 2022
• CVE-2022-3978NodeBB abort cross-site request forgery4.3Nov 13, 2022
• CVE-2022-36076Account takeover via SSO plugins in NodeBB8.8Sep 2, 2022
• CVE-2022-36045Account takeover via cryptographically weak PRNG in NodeBB Forum9.0Aug 31, 2022
• CVE-2021-43788Path traversal in translator module of NobeBB5.0Nov 29, 2021