Novuhq

6 CVEs in 1 Novuhq product, including Novu. Newest: CVE-2026-125115 (2026-11-09). Severity, EPSS and public exploits for each.

Novuhq products with known CVEs

ProductCVEs
Novu6
Novuhq CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-125115Medium6.82026-11-09Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-valid…
CVE-2026-1251142026-11-09Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecas…
CVE-2026-75517Medium6.52026-09-22Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, up…
CVE-2026-755112026-09-22Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUr…
CVE-2026-755102026-09-22Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component acc…
CVE-2023-35948Medium5.42023-07-06Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with…