Nocodb vulnerabilities
60 CVEs and advisories name Nocodb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121736NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
- CVE-2026-119715NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers
- CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
- CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
- CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
- CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags
- CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base members
- CVE-2026-46553NocoDB: Attachment Size Limit Bypass via Upload-by-URL
- CVE-2026-47375NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
- CVE-2026-47376NocoDB: Reflected Cross-Site Scripting via Password Reset Token
- CVE-2026-47377NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
- CVE-2026-47378NocoDB: Hidden Column Exposure in Public Shared View Endpoints
- CVE-2026-47380NocoDB: User Enumeration via Sign-In Timing
- CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
- CVE-2026-46554NocoDB: Stale Auth Cache After API Token Deletion
- CVE-2026-47382NocoDB: Server-Side Request Forgery via Database Connection Host
- CVE-2026-47279NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints
- CVE-2026-47379NocoDB: Plaintext Password Comparison in Shared Views
- CVE-2026-47381NocoDB: Cross-Workspace Integration Use in Connection Test
- CVE-2026-47383NocoDB: Stored Cross-Site Scripting via Row Comments
- CVE-2026-47384NocoDB: SQL Injection via Column Title in Bulk GroupBy
- CVE-2026-47385NocoDB: Path Traversal via SQLite Source Filename
- CVE-2026-47386NocoDB: OAuth Authorization Code Race Condition
- CVE-2026-47387NocoDB: Stored Cross-Site Scripting via Form View Redirect URL
- CVE-2026-47388NocoDB: Missing Ownership Check in MCP Attachment Read
- CVE-2026-53926NocoDB: OAuth Tokens Persist Through Security Events
- CVE-2026-53927NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
- CVE-2026-53928NocoDB: Refresh Tokens Persist Through Password Recovery
- CVE-2026-53929NocoDB: Stored Cross-Site Scripting via Secure Attachment
- CVE-2026-53930NocoDB: Server-Side Request Forgery via Base Migration URL