cve.bz

novuhq novu vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 6.8CVE-2026-125115EPSS 0.3%

    Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/…

  2. 8.3CVE-2026-125114EPSS 0.3%

    Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured chi…

  3. 6.5CVE-2026-75517EPSS 0.7%

    Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary loo…

  4. 5.3CVE-2026-75511EPSS 0.5%

    Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.…

  5. 5.1CVE-2026-75510EPSS 0.5%

    Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and p…