Product

nocobase @nocobase/plugin-action-custom-request vulnerabilities

1 published CVE affecting nocobase @nocobase/plugin-action-custom-request, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Latest nocobase @nocobase/plugin-action-custom-request CVEs

Newest publication first

CVE-2026-79914 NocoBase: SSRF in customRequests:send via runtime options.url override
Published 2026-11-10

MediumCVSS 4.3 EPSS 0.25%

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

nocobase @nocobase/plugin-action-custom-request vulnerabilities

Latest nocobase @nocobase/plugin-action-custom-request CVEs

CVE-2026-79914 NocoBase: SSRF in customRequests:send via runtime options.url override