CVEs we hold for Nocodb
Records whose assigning authority named Nocodb as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-53931NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpointnocodb CVE-2026-53930NocoDB: Server-Side Request Forgery via Base Migration URLnocodb CVE-2026-53929NocoDB: Stored Cross-Site Scripting via Secure Attachmentnocodb CVE-2026-53928NocoDB: Refresh Tokens Persist Through Password Recoverynocodb CVE-2026-53927NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URLnocodb CVE-2026-53926NocoDB: OAuth Tokens Persist Through Security Eventsnocodb CVE-2026-47388NocoDB: Missing Ownership Check in MCP Attachment Readnocodb CVE-2026-47387NocoDB: Stored Cross-Site Scripting via Form View Redirect URLnocodb CVE-2026-47384NocoDB: SQL Injection via Column Title in Bulk GroupBynocodb CVE-2026-47383NocoDB: Stored Cross-Site Scripting via Row Commentsnocodb CVE-2026-47382NocoDB: Server-Side Request Forgery via Database Connection Hostnocodb CVE-2026-47381NocoDB: Cross-Workspace Integration Use in Connection Testnocodb CVE-2026-47379NocoDB: Plaintext Password Comparison in Shared Viewsnocodb CVE-2026-47378NocoDB: Hidden Column Exposure in Public Shared View Endpointsnocodb CVE-2026-47377NocoDB: Open Redirect via Hash Fragment in hashRedirect Pluginnocodb CVE-2026-47376NocoDB: Reflected Cross-Site Scripting via Password Reset Tokennocodb CVE-2026-47375NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`nocodb CVE-2026-47279NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpointsnocodb CVE-2026-46553NocoDB: Attachment Size Limit Bypass via Upload-by-URLnocodb CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base membersnocodb CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustionnocodb CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flagsnocodb CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalationnocodb CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)nocodb CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URLnocodb CVE-2026-28401NocoDB: Stored Cross-Site Scripting via Rich Text Cellsnocodb CVE-2026-28398NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cellsnocodb CVE-2026-28396NocoDB: Refresh Tokens Not Revoked on Password Resetnocodb CVE-2026-28361NocoDB: Missing Ownership Validation in MCP Token Operationsnocodb CVE-2026-28360NocoDB: Plaintext Storage of Shared View Passwordsnocodb CVE-2026-28359NocoDB: Stored Cross-Site Scripting via Rich Text Fieldnocodb CVE-2026-28358NocoDB: User Enumeration via Password Reset Endpointnocodb CVE-2026-28357NocoDB: Stored Cross-Site Scripting via Formula Cellnocodb CVE-2026-24769NocoDB Vulnerable to Stored Cross-Site Scripting via SVG uploadnocodb CVE-2026-24768NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameternocodb CVE-2026-24767NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionalitynocodb CVE-2026-24766NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoSnocodb CVE-2025-27506NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Pagenocodb CVE-2023-5104Improper Input Validation in nocodb/nocodbnocodb/nocodb CVE-2023-50717NocoDB Allows Preview of File with Dangerous Contentnocodb CVE-2023-49781NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vuenocodb CVE-2022-3423Allocation of Resources Without Limits or Throttling in nocodb/nocodbnocodb/nocodb CVE-2022-2339Server-Side Request Forgery (SSRF) in nocodb/nocodbnocodb/nocodb CVE-2022-22120NocoDB - Observable Discrepancy in the password-reset featurenocodb CVE-2022-2079Cross-site Scripting (XSS) - Stored in nocodb/nocodbnocodb/nocodb CVE-2022-2064Insufficient Session Expiration in nocodb/nocodbnocodb/nocodb CVE-2022-2063Improper Privilege Management in nocodb/nocodbnocodb/nocodb CVE-2022-2062Generation of Error Message Containing Sensitive Information in nocodb/nocodbnocodb/nocodb CVE-2022-2022Cross-site Scripting (XSS) - Stored in nocodb/nocodbnocodb/nocodb 58 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.