MEDIUM4.7npm
GHSA-4qcv-qf38-5j3j· CVE-2023-2850Unintentional leakage of private information via cross-origin websocket session hijacking
Modified: 7/8/2026
package
npm/nodebb
pkg:npm/nodebb
MEDIUM4.3npm
GHSA-5gwx-wf9g-r5mx· CVE-2022-3978NodeBB vulnerable to Cross-Site Request Forgery
Modified: 11/8/2023
MEDIUM6.1npm
GHSA-72fv-qgj6-2w2p· CVE-2015-9286Cross-site Scripting in NodeBB
Modified: 11/8/2023
MEDIUM6.1npm
GHSA-9g4f-5rpg-4948· CVE-2015-3296NodeBB Cross-site Scripting Vulnerability in Markdown Processing
Modified: 9/10/2026
CRITICAL9.8npm
GHSA-hf2m-j98r-4fqw· CVE-2021-43786API token verification can be bypassed in NodeBB
Modified: 7/8/2026
CRITICAL9.8npm
GHSA-p4cc-w597-6cpm· CVE-2022-36045Cryptographically weak PRNG in `utils.generateUUID`
Modified: 11/8/2023
MEDIUM5.0npm
GHSA-pfj7-2qfw-vwgm· CVE-2021-43788NodeBB vulnerable to path traversal in translator module
Modified: 7/8/2026
MEDIUM6.3npm
GHSA-qc99-r4wh-c8h6· CVE-2024-29316Incorrect Access Control in NodeBB
Modified: 11/18/2024
CRITICAL9.4npm
GHSA-rf3g-v8p5-p675· CVE-2022-46164NodeBB vulnerable to account takeover via prototype vulnerability
Modified: 11/8/2023
HIGHnpm
GHSA-rfh2-8vxq-jqr8· CVE-2025-50979NodeBB SQL Injection vulnerability
Modified: 8/27/2025
CRITICAL10.0npm
GHSA-vh2g-6c4x-5hmp· CVE-2023-26045Path traversal and code execution via prototype vulnerability
Modified: 9/10/2026
MEDIUM4.6npm
GHSA-vqr3-vrrg-f3jh· CVE-2024-57041NodeBB Cross-site scripting (XSS) vulnerability
Modified: 2/7/2025
CRITICAL9.0npm
GHSA-wx69-rvg3-x7fc· CVE-2021-43787XSS via prototype pollution in NodeBB
Modified: 7/8/2026
HIGH7.5npm
GHSA-xmgg-fx9p-prq6· CVE-2022-36076NodeBB account takeover via SSO plugins
Modified: 11/8/2023