Nnocodb

Products

Exploited and recent CVEs

• CVE-2026-121736 Medium 5.3 NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation 0.3%
• CVE-2026-119715 Medium 4.3 NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers 0.2%
• CVE-2026-46547 Medium 6.1 NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL 0.3%
• CVE-2026-46548 Medium 4.3 NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) 0.3%
• CVE-2026-46549 Low 2.0 NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation 0.2%
• CVE-2026-46550 Medium 5.4 NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags 0.2%
• CVE-2026-46552 Medium 5.8 NocoDB: Shared-base link access can invite arbitrary users as persistent base members 0.3%
• CVE-2026-46553 Low 2.1 NocoDB: Attachment Size Limit Bypass via Upload-by-URL 0.4%
• CVE-2026-47375 Medium 6.0 NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` 0.4%
• CVE-2026-47376 Medium 5.1 NocoDB: Reflected Cross-Site Scripting via Password Reset Token 0.4%
• CVE-2026-47377 Medium 5.1 NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin 0.4%
• CVE-2026-47378 Medium 6.9 NocoDB: Hidden Column Exposure in Public Shared View Endpoints 0.4%
• CVE-2026-47380 Medium 6.3 NocoDB: User Enumeration via Sign-In Timing 0.3%
• CVE-2026-46551 Medium 6.5 NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion 0.4%
• CVE-2026-46554 Low 2.3 NocoDB: Stale Auth Cache After API Token Deletion 0.3%
• CVE-2026-47382 Medium 5.3 NocoDB: Server-Side Request Forgery via Database Connection Host 0.4%
• CVE-2026-47279 Medium 6.9 NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints 0.4%
• CVE-2026-47379 Medium 6.9 NocoDB: Plaintext Password Comparison in Shared Views 0.4%
• CVE-2026-47381 Medium 6.9 NocoDB: Cross-Workspace Integration Use in Connection Test 0.4%
• CVE-2026-47383 High 7.4 NocoDB: Stored Cross-Site Scripting via Row Comments 0.4%
• CVE-2026-47384 Medium 5.3 NocoDB: SQL Injection via Column Title in Bulk GroupBy 0.4%
• CVE-2026-47385 Medium 5.3 NocoDB: Path Traversal via SQLite Source Filename 0.4%
• CVE-2026-47386 Medium 6.3 NocoDB: OAuth Authorization Code Race Condition 0.3%
• CVE-2026-47387 High 8.4 NocoDB: Stored Cross-Site Scripting via Form View Redirect URL 0.4%
• CVE-2026-47388 Low 2.3 NocoDB: Missing Ownership Check in MCP Attachment Read 0.3%
• CVE-2026-53926 Medium 6.3 NocoDB: OAuth Tokens Persist Through Security Events 0.4%
• CVE-2026-53927 Medium 5.1 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL 0.4%
• CVE-2026-53928 Medium 6.3 NocoDB: Refresh Tokens Persist Through Password Recovery 0.4%
• CVE-2026-53929 Medium 5.1 NocoDB: Stored Cross-Site Scripting via Secure Attachment 0.4%
• CVE-2026-53930 Medium 5.1 NocoDB: Server-Side Request Forgery via Base Migration URL 0.4%