Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Oct 19, 2026NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassiCVE-2026-112306 · Other software · nocobase · reported by VulnCheckHigh 8.6
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HCVE-2026-88403 · Other software · reported by MITREMedium 6.5
A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL stCVE-2026-88402 · Other software · reported by MITRECritical 9.8
A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers.CVE-2026-84701 · Other software · nocobase · reported by VulnCheckMedium 5.1
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-55410 · Other software · nocobase · reported by GitHubMedium 6.7
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-52888 · Other software · nocobase · reported by GitHubMedium 6.8
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-52887 · Other software · nocobase · reported by GitHubCritical 10
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbiCVE-2026-58468 · Other software · nocobase · reported by VulnCheckMedium 5.1
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. Attackers can target loopback addresses, RFC-1918 private ranges, and cloud instance metadata endpoints to perform internal network port enumeration, host discovery, and retrieval of IAM role credentials from the instance metadata service. v2.1.18 added a warning message for when SERVER_REQUEST_WHITELIST is not configured.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-41641 · Other software · nocobase · reported by GitHubHigh 7.2
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-41640 · Other software · nocobase · reported by GitHubHigh 7.5
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-40346 · Other software · nocobase · reported by GitHubMedium 6.4
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.
- Product
- @nocobase/plugin-workflow-request
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23.CVE-2026-6224 · Other software · nocobase · reported by VulDBMedium 5.5
A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- plugin-workflow-javascript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-34825 · Other software · nocobase · reported by GitHubHigh 8.5
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL. This issue has been patched in version 2.0.30.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-34156 · Other software · nocobase · reported by GitHubCritical 9.9
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37.CVE-2025-13877 · Other software · reported by VulDBLow 2.9
A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. The affected element is an unknown function of the file nocobase\packages\core\auth\src\base\jwt-service.ts of the component JWT Service. The manipulation of the argument API_KEY results in use of hard-coded cryptographic key . The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.