CVE WatchJul 16, 2026

CVE-2026-52888

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, Noco

CVSS

6.8

Medium

EPSS

0.3%

p19

KEV

—

Exploit Today

0-100

Published: Jul 15, 2026 · Last modified: Jul 16, 2026 · CWE-184 · CWE-200

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-07-162026-07-21

Technical description

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-650094.3 MED

—

——0OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.5h CVE-2026-445088.1 HIG

19.4%

——6Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver's compressed-token decoder accumulated a 32-bit signed counter without checking for overflow. A malicious sender can trigger an overflow that with careful manipulation can lead to the extraction of data stored in memory of the process allowing an attacker to access environment variables, passwords and memory pointers from the heap, stack, and libraries. The leakage of these pointers and data can significantly reduce the effectiveness of ASLR and facilitate further exploitation. This issue is fixed in version 3.4.3.20h CVE-2026-442319.1 CRI

33.4%

——10RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.4h CVE-2026-631088.8 HIG

77.7%

——23Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.19h CVE-2026-60031—

16.7%

——5The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses.22h CVE-2026-510279.9 CRI

26.6%

——8An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.22h