CVE-2026-84701

MediumCVSS 5.4/10Last modified Sep 16, 2026

Description

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 2, 2026
Last modified
Sep 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-847027.5facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directoCVE-2026-847067.6A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates CVE-2026-847125.3A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ CVE-2026-847136.5A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ CVE-2026-847147.1A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular CVE-2026-847158.8FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated suCVE-2026-847166.6A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads CVE-2026-847175.3A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips CVE-2026-847184.3A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts thCVE-2026-847199.9A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission saCVE-2026-84724.3GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 thatCVE-2026-847206.5A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which sto
CVE-2026-84701: Medium severity, CVSS 5.4 | Vulnix