https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 19:08:01 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-95237 cnvd-2021-95237 https://cve.radiocsirt.org/vuln/cnvd-2021-95237 https://cve.radiocsirt.org/vuln/euvd-2026-32661 EUVD-2026-32661 https://cve.radiocsirt.org/vuln/euvd-2026-32661 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43787 <p>Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.</p> <p>Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-43787 https://cve.radiocsirt.org/vuln/ghsa-wx69-rvg3-x7fc <p><strong>Affected:</strong> npm: nodebb</p> <p>### Impact A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report.</p> <p>### Patches The vulnerability has been patched as of v1.18.5.</p> <p>### Workarounds Cherry-pick commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade.</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [security@nodebb.org](mailto:security@nodebb.org)</p> <p><strong>Affected:</strong> npm: nodebb</p> <p>### Impact A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report.</p> <p>### Patches The vulnerability has been patched as of v1.18.5.</p> <p>### Workarounds Cherry-pick commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade.</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [security@nodebb.org](mailto:security@nodebb.org)</p> https://cve.radiocsirt.org/vuln/ghsa-wx69-rvg3-x7fc https://cve.radiocsirt.org/vuln/gsd-2021-43787 gsd-2021-43787 https://cve.radiocsirt.org/vuln/gsd-2021-43787