Advisories · Technology

NodeBB.

Every CVE that names NodeBB among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120007 CVE record

CVSS 6.9 Medium

NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid
- NodeBB
- Broken access control
Not analysed yet 30 Oct 2026
CVE-2026-73038 CVE record

CVSS 5.3 Medium

NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name
- NodeBB
- Cross-site scripting (XSS)
Not analysed yet 13 Aug 2026
CVE-2026-58593 CVE record

CVSS 8.7 High

NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User
- NodeBB
- Authentication bypass
- CWE-345
Not analysed yet 1 Jul 2026
CVE-2023-30591 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

NodeBB Pre-Authentication Denial-of-Service
- NodeBB
- CWE-241
Not analysed yet 29 Sept 2023
CVE-2020-15149 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Account takeover in NodeBB
- NodeBB
- Privilege escalation
Not analysed yet 19 Aug 2020