nocobase has 4 CVEs on record. 3 were published in the last 90 days. The median CVSS is 9.9 (critical), with 2 rated critical.
CVEs per month
Last 12 months, by publish date
1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.9
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Products
- @nocobase/plugin-collection-sql 1
- @nocobase/plugin-notification-in-app-message 1
- @nocobase/server 1
- nocobase 1
4
Total CVEs
2
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-34156Critical· 9.9NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions73CVE-2026-52887Critical· 10.0NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE67GHSA-ghvf-qf6h-g8x5HighNocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution41CVE-2026-52888Medium· 6.8NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass37
nocobase vulnerabilities
CVEs affecting nocobase, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
GHSA-ghvf-qf6h-g8x5HighNocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
▾ Twilightnocobase · @nocobase/servervia GHSA
CVE-2026-52887Critical· 10.0PoCNocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
▾ Abyssalnocobase · @nocobase/plugin-notification-in-app-messageEPSS 0.89%via GHSA
CVE-2026-52888Medium· 6.8NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
▾ Sunlitnocobase · @nocobase/plugin-collection-sqlEPSS 0.47%via GHSA
CVE-2026-34156Critical· 9.9PoCNocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with …
▾ Abyssalnocobase · nocobaseEPSS 35%via NVD