https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T19:44:24.290328+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-95237 cnvd-2021-95237 2026-10-16T19:44:24.373562+00:00 cnvd-2021-95237 https://cve.radiocsirt.org/vuln/euvd-2026-32661 EUVD-2026-32661 2026-10-16T19:44:24.373613+00:00 EUVD-2026-32661 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43787 fkie_cve-2021-43787 2026-10-16T19:44:24.373642+00:00

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

 https://cve.radiocsirt.org/vuln/ghsa-wx69-rvg3-x7fc GHSA-wx69-rvg3-x7fc — XSS via prototype pollution in NodeBB 2026-10-16T19:44:24.373695+00:00

Affected: npm: nodebb

### Impact A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report.

### Patches The vulnerability has been patched as of v1.18.5.

### Workarounds Cherry-pick commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade.

### For more information If you have any questions or comments about this advisory: * Email us at [security@nodebb.org](mailto:security@nodebb.org)

 https://cve.radiocsirt.org/vuln/gsd-2021-43787 gsd-2021-43787 2026-10-16T19:44:24.373749+00:00 gsd-2021-43787