nocobase vulnerabilities

Newest CVEs

• CVE-2026-112306

  NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

  nocobase · nocobase

  High8.6
• CVE-2026-84701

  NocoBase Rich Text Field Stored Cross-Site Scripting via API

  nocobase · nocobase

  Medium5.1
• CVE-2026-55410

  NocoBase backup restore schema name allows command injection

  nocobase · nocobase

  Medium6.7
• CVE-2026-52887

  NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

  nocobase · nocobase

  Critical10.0
• CVE-2026-52888

  NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

  nocobase · nocobase

  Medium6.8
• CVE-2026-58468

  NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper

  nocobase · nocobase

  Medium5.1
• CVE-2026-41641

  NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call

  nocobase · nocobase

  High7.2
• CVE-2026-41640

  NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading

  nocobase · nocobase

  High7.5
• CVE-2026-40346

  NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

  nocobase · @nocobase/plugin-workflow-request

  Medium6.4
• CVE-2026-6224

  nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox

  nocobase · plugin-workflow-javascript

  Medium6.9