Nocodb vulnerabilities

Products

• Nocodb 66
• Nocodb/nocodb 8

Newest

• nocodb NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation CVE-2026-121736 6.9 MediumNovember 3, 2026
• nocodb NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers CVE-2026-119715 5.3 MediumOctober 30, 2026
• nocodb NocoDB signup validatePassword excessive authentication CVE-2026-116123 6.3 MediumOctober 26, 2026
• nocodb NocoDB Sign-in Endpoint AuthService.validateUser information disclosure CVE-2026-116122 6.3 MediumOctober 26, 2026
• nocodb NocoDB Registration users.service.ts race condition CVE-2026-116121 6.3 MediumOctober 26, 2026
• nocodb NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources CVE-2026-116120 6.3 MediumOctober 26, 2026
• nocodb NocoDB Password-Reset Flow users.service.ts race condition CVE-2026-116119 5.1 MediumOctober 26, 2026
• nocodb NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint CVE-2026-53931 6.9 MediumJune 17, 2026
• nocodb NocoDB: Server-Side Request Forgery via Base Migration URL CVE-2026-53930 5.1 MediumJune 17, 2026
• nocodb NocoDB: Stored Cross-Site Scripting via Secure Attachment CVE-2026-53929 5.1 MediumJune 17, 2026
• nocodb NocoDB: Refresh Tokens Persist Through Password Recovery CVE-2026-53928 6.3 MediumJune 17, 2026
• nocodb NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL CVE-2026-53927 5.1 MediumJune 17, 2026
• nocodb NocoDB: OAuth Tokens Persist Through Security Events CVE-2026-53926 Fix available 6.3 MediumJune 5, 2026
• nocodb NocoDB: Missing Ownership Check in MCP Attachment Read CVE-2026-47388 Fix available 2.3 LowJune 5, 2026
• nocodb NocoDB: Stored Cross-Site Scripting via Form View Redirect URL CVE-2026-47387 Fix available 8.4 HighJune 5, 2026
• nocodb NocoDB: OAuth Authorization Code Race Condition CVE-2026-47386 Fix available 6.3 MediumJune 5, 2026
• nocodb NocoDB: Path Traversal via SQLite Source Filename CVE-2026-47385 Fix available 5.3 MediumJune 5, 2026
• nocodb NocoDB: SQL Injection via Column Title in Bulk GroupBy CVE-2026-47384 Fix available 5.3 MediumJune 5, 2026
• nocodb NocoDB: Stored Cross-Site Scripting via Row Comments CVE-2026-47383 Fix available 7.4 HighJune 5, 2026
• nocodb NocoDB: Server-Side Request Forgery via Database Connection Host CVE-2026-47382 Fix available 5.3 MediumJune 5, 2026
• nocodb NocoDB: Cross-Workspace Integration Use in Connection Test CVE-2026-47381 Fix available 6.9 MediumJune 5, 2026
• nocodb NocoDB: User Enumeration via Sign-In Timing CVE-2026-47380 Fix available 6.3 MediumJune 5, 2026
• nocodb NocoDB: Plaintext Password Comparison in Shared Views CVE-2026-47379 Fix available 6.9 MediumJune 5, 2026
• nocodb NocoDB: Hidden Column Exposure in Public Shared View Endpoints CVE-2026-47378 Fix available 6.9 MediumJune 5, 2026
• nocodb NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin CVE-2026-47377 Fix available 5.1 MediumJune 5, 2026
• nocodb NocoDB: Reflected Cross-Site Scripting via Password Reset Token CVE-2026-47376 Fix available 5.1 MediumJune 5, 2026
• nocodb NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` CVE-2026-47375 Fix available 6.0 MediumJune 5, 2026
• nocodb NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints CVE-2026-47279 Fix available 6.9 MediumJune 5, 2026
• nocodb NocoDB: Stale Auth Cache After API Token Deletion CVE-2026-46554 2.3 LowMay 21, 2026
• nocodb NocoDB: Attachment Size Limit Bypass via Upload-by-URL CVE-2026-46553 2.1 LowMay 21, 2026
• nocodb NocoDB: Shared-base link access can invite arbitrary users as persistent base members CVE-2026-46552 Public exploit 5.8 MediumMay 21, 2026
• nocodb NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion CVE-2026-46551 6.5 MediumMay 21, 2026
• nocodb NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags CVE-2026-46550 5.4 MediumMay 21, 2026
• nocodb NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation CVE-2026-46549 2.0 LowMay 21, 2026
• nocodb NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) CVE-2026-46548 4.3 MediumMay 21, 2026
• nocodb NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL CVE-2026-46547 6.1 MediumMay 21, 2026
• nocodb NocoDB: Stored Cross-Site Scripting via Rich Text Cells CVE-2026-28401 Fix available 5.3 MediumMarch 2, 2026
• nocodb NocoDB: SQL Injection via DATEADD Formula CVE-2026-28399 Fix available 6.2 MediumMarch 2, 2026
• nocodb NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells CVE-2026-28398 Fix available 5.3 MediumMarch 2, 2026
• nocodb NocoDB: Stored Cross-Site Scripting via Comments CVE-2026-28397 Fix available 5.3 MediumMarch 2, 2026
• nocodb NocoDB: Refresh Tokens Not Revoked on Password Reset CVE-2026-28396 Fix available 4.9 MediumMarch 2, 2026
• nocodb NocoDB: Missing Ownership Validation in MCP Token Operations CVE-2026-28361 Fix available 4.9 MediumMarch 2, 2026
• nocodb NocoDB: Plaintext Storage of Shared View Passwords CVE-2026-28360 Fix available 2.7 LowMarch 2, 2026
• nocodb NocoDB: Stored Cross-Site Scripting via Rich Text Field CVE-2026-28359 Fix available 5.3 MediumMarch 2, 2026
• nocodb NocoDB: User Enumeration via Password Reset Endpoint CVE-2026-28358 Fix available 2.7 LowMarch 2, 2026
• nocodb NocoDB: Stored Cross-Site Scripting via Formula Cell CVE-2026-28357 Fix available 5.3 MediumMarch 2, 2026
• nocodb NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload CVE-2026-24769 Fix available 8.5 HighJanuary 28, 2026
• nocodb NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter CVE-2026-24768 Fix available 5.7 MediumJanuary 28, 2026
• nocodb NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality CVE-2026-24767 Fix available 4.9 MediumJanuary 28, 2026
• nocodb NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS CVE-2026-24766 Fix available 4.9 MediumJanuary 28, 2026
• Show olderLoading…