Vulnerabilities in NodeBB
13 resultsCVE-2022-46164CRITICALAccount takeover via prototype vulnerabilityEPSS 47.4%CVE-2021-43788MEDIUMPath traversal in translator module of NobeBBEPSS 25.8%CVE-2020-15149CRITICALAccount takeover in NodeBBEPSS 2.4%CVE-2021-43786CRITICALAPI token verification can be bypassedEPSS 2.4%CVE-2022-36045CRITICALAccount takeover via cryptographically weak PRNG in NodeBB ForumEPSS 1.3%CVE-2021-43787CRITICALXSS via prototype pollutionEPSS 1.3%CVE-2023-26045CRITICALNodeBB vulnerable to path traversal and code execution via prototype vulnerabilityEPSS 1.0%CVE-2021-47746HIGHNodeBB Plugin Emoji 3.2.1 - Arbitrary File WriteEPSS 0.7%CVE-2022-36076HIGHAccount takeover via SSO plugins in NodeBBEPSS 0.6%CVE-2026-120007MEDIUMNodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uidEPSS 0.3%CVE-2023-2850MEDIUMNodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vEPSS 0.3%CVE-2026-58593HIGHNodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local UserEPSS 0.3%CVE-2026-73038MEDIUMNodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.nameEPSS 0.2%