Vendor

    NodeBB

    24 known vulnerabilities in products by NodeBB, 0 of them actively exploited (CISA KEV).

    Key figures

    24

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in NodeBB
    CriticalCVE-2023-43187

    NodeBB: Remote Code Execution

    		9.8
    CriticalCVE-2022-46164

    Account takeover via prototype vulnerability

    		9.4
    HighCVE-2025-50979

    NodeBB: SQL Injection

    		8.6
    HighCVE-2023-30591

    NodeBB Pre-Authentication Denial-of-Service

    		7.5
    MediumCVE-2025-29513

    NodeBB: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2024-57041

    NodeBB: Cross-Site Scripting (XSS)

    		4.6
    CriticalCVE-2020-15149

    Account takeover in NodeBB

    		9.9
    CriticalCVE-2021-43786

    API token verification can be bypassed

    		9.8
    MediumCVE-2021-43788

    Path traversal in translator module of NobeBB

    		5.0
    CriticalCVE-2022-36045

    Account takeover via cryptographically weak PRNG in NodeBB Forum

    		9.0
    CriticalCVE-2023-26045

    NodeBB vulnerable to path traversal and code execution via prototype vulnerability

    		10.0
    CriticalCVE-2021-43787

    XSS via prototype pollution

    		9.0
    HighCVE-2021-47746

    NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write

    		7.5
    MediumCVE-2015-9286

    NodeBB: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2026-120007

    NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid

    		6.5
    MediumCVE-2015-3296

    NodeBB: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2026-58593

    NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User

    		7.5
    HighCVE-2022-36076

    Account takeover via SSO plugins in NodeBB

    		8.8
    MediumCVE-2026-73038

    NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name

    		6.1
    HighCVE-2020-15156

    XSS due to lack of CSRF validation for replying/publishing

    		6.8
    MediumCVE-2024-29316

    NodeBB: Improper Access Control

    		6.3
    MediumCVE-2025-29512

    NodeBB: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2023-2850

    NodeBB: Missing Origin Validation in WebSockets

    		4.7
    MediumCVE-2022-3978

    NodeBB abort cross-site request forgery

    		4.3

    Products

    Products by NodeBB
    NodeBB220