# cve.now: Nocodb

The newest entries naming Nocodb as an affected vendor (up to 200), of 60 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121736](https://cve.now/CVE-2026-121736.md): NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation (CVSS 6.9)
- [CVE-2026-119715](https://cve.now/CVE-2026-119715.md): NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers (CVSS 5.3)
- [CVE-2026-46547](https://cve.now/CVE-2026-46547.md): NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL (CVSS 6.1)
- [CVE-2026-46548](https://cve.now/CVE-2026-46548.md): NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) (CVSS 4.3)
- [CVE-2026-46549](https://cve.now/CVE-2026-46549.md): NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation (CVSS 2.0)
- [CVE-2026-46550](https://cve.now/CVE-2026-46550.md): NocoDB: Refresh Token Cookie Set Without \`Secure\` and \`SameSite\` Flags (CVSS 5.4)
- [CVE-2026-46552](https://cve.now/CVE-2026-46552.md): NocoDB: Shared-base link access can invite arbitrary users as persistent base members (CVSS 5.8)
- [CVE-2026-46553](https://cve.now/CVE-2026-46553.md): NocoDB: Attachment Size Limit Bypass via Upload-by-URL (CVSS 2.1)
- [CVE-2026-47375](https://cve.now/CVE-2026-47375.md): NocoDB: Postgres SQL Injection in Formula \`ARRAYSORT\` (CVSS 6.0)
- [CVE-2026-47376](https://cve.now/CVE-2026-47376.md): NocoDB: Reflected Cross-Site Scripting via Password Reset Token (CVSS 5.1)
- [CVE-2026-47377](https://cve.now/CVE-2026-47377.md): NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin (CVSS 5.1)
- [CVE-2026-47378](https://cve.now/CVE-2026-47378.md): NocoDB: Hidden Column Exposure in Public Shared View Endpoints (CVSS 6.9)
- [CVE-2026-47380](https://cve.now/CVE-2026-47380.md): NocoDB: User Enumeration via Sign-In Timing (CVSS 6.3)
- [CVE-2026-46551](https://cve.now/CVE-2026-46551.md): NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion (CVSS 6.5)
- [CVE-2026-46554](https://cve.now/CVE-2026-46554.md): NocoDB: Stale Auth Cache After API Token Deletion (CVSS 2.3)
- [CVE-2026-47382](https://cve.now/CVE-2026-47382.md): NocoDB: Server-Side Request Forgery via Database Connection Host (CVSS 5.3)
- [CVE-2026-47279](https://cve.now/CVE-2026-47279.md): NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints (CVSS 6.9)
- [CVE-2026-47379](https://cve.now/CVE-2026-47379.md): NocoDB: Plaintext Password Comparison in Shared Views (CVSS 6.9)
- [CVE-2026-47381](https://cve.now/CVE-2026-47381.md): NocoDB: Cross-Workspace Integration Use in Connection Test (CVSS 6.9)
- [CVE-2026-47383](https://cve.now/CVE-2026-47383.md): NocoDB: Stored Cross-Site Scripting via Row Comments (CVSS 7.4)
- [CVE-2026-47384](https://cve.now/CVE-2026-47384.md): NocoDB: SQL Injection via Column Title in Bulk GroupBy (CVSS 5.3)
- [CVE-2026-47385](https://cve.now/CVE-2026-47385.md): NocoDB: Path Traversal via SQLite Source Filename (CVSS 5.3)
- [CVE-2026-47386](https://cve.now/CVE-2026-47386.md): NocoDB: OAuth Authorization Code Race Condition (CVSS 6.3)
- [CVE-2026-47387](https://cve.now/CVE-2026-47387.md): NocoDB: Stored Cross-Site Scripting via Form View Redirect URL (CVSS 8.4)
- [CVE-2026-47388](https://cve.now/CVE-2026-47388.md): NocoDB: Missing Ownership Check in MCP Attachment Read (CVSS 2.3)
- [CVE-2026-53926](https://cve.now/CVE-2026-53926.md): NocoDB: OAuth Tokens Persist Through Security Events (CVSS 6.3)
- [CVE-2026-53927](https://cve.now/CVE-2026-53927.md): NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL (CVSS 5.1)
- [CVE-2026-53928](https://cve.now/CVE-2026-53928.md): NocoDB: Refresh Tokens Persist Through Password Recovery (CVSS 6.3)
- [CVE-2026-53929](https://cve.now/CVE-2026-53929.md): NocoDB: Stored Cross-Site Scripting via Secure Attachment (CVSS 5.1)
- [CVE-2026-53930](https://cve.now/CVE-2026-53930.md): NocoDB: Server-Side Request Forgery via Base Migration URL (CVSS 5.1)
- [CVE-2026-53931](https://cve.now/CVE-2026-53931.md): NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint (CVSS 6.9)
- [CVE-2026-28401](https://cve.now/CVE-2026-28401.md): NocoDB: Stored Cross-Site Scripting via Rich Text Cells (CVSS 5.3)
- [CVE-2026-28399](https://cve.now/CVE-2026-28399.md): NocoDB: SQL Injection via DATEADD Formula (CVSS 6.2)
- [CVE-2026-28398](https://cve.now/CVE-2026-28398.md): NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells (CVSS 5.3)
- [CVE-2026-28397](https://cve.now/CVE-2026-28397.md): NocoDB: Stored Cross-Site Scripting via Comments (CVSS 5.3)
- [CVE-2026-28396](https://cve.now/CVE-2026-28396.md): NocoDB: Refresh Tokens Not Revoked on Password Reset (CVSS 4.9)
- [CVE-2026-28361](https://cve.now/CVE-2026-28361.md): NocoDB: Missing Ownership Validation in MCP Token Operations (CVSS 4.9)
- [CVE-2026-28360](https://cve.now/CVE-2026-28360.md): NocoDB: Plaintext Storage of Shared View Passwords (CVSS 2.7)
- [CVE-2026-28359](https://cve.now/CVE-2026-28359.md): NocoDB: Stored Cross-Site Scripting via Rich Text Field (CVSS 5.3)
- [CVE-2026-28358](https://cve.now/CVE-2026-28358.md): NocoDB: User Enumeration via Password Reset Endpoint (CVSS 2.7)
- [CVE-2026-28357](https://cve.now/CVE-2026-28357.md): NocoDB: Stored Cross-Site Scripting via Formula Cell (CVSS 5.3)
- [CVE-2026-24769](https://cve.now/CVE-2026-24769.md): NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload (CVSS 8.5)
- [CVE-2026-24768](https://cve.now/CVE-2026-24768.md): NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter (CVSS 5.7)
- [CVE-2026-24767](https://cve.now/CVE-2026-24767.md): NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality (CVSS 4.9)
- [CVE-2026-24766](https://cve.now/CVE-2026-24766.md): NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS (CVSS 4.9)
- [CVE-2025-27506](https://cve.now/CVE-2025-27506.md): NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page (CVSS 5.4)
- [CVE-2023-49781](https://cve.now/CVE-2023-49781.md): NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue (CVSS 7.3)
- [CVE-2023-50718](https://cve.now/CVE-2023-50718.md): NocoDB SQL Injection vulnerability (CVSS 6.5)
- [CVE-2023-50717](https://cve.now/CVE-2023-50717.md): NocoDB Allows Preview of File with Dangerous Content (CVSS 5.7)
- [CVE-2023-43794](https://cve.now/CVE-2023-43794.md): SQL Injection in nocodb (CVSS 6.5)
- [CVE-2023-5104](https://cve.now/CVE-2023-5104.md): Improper Input Validation in nocodb/nocodb (CVSS 5.7)
- [CVE-2022-3423](https://cve.now/CVE-2022-3423.md): Allocation of Resources Without Limits or Throttling in nocodb/nocodb (CVSS 7.3)
- [CVE-2022-2339](https://cve.now/CVE-2022-2339.md): Server-Side Request Forgery (SSRF) in nocodb/nocodb (CVSS 9.1)
- [CVE-2022-2079](https://cve.now/CVE-2022-2079.md): Cross-site Scripting (XSS) - Stored in nocodb/nocodb (CVSS 7.3)
- [CVE-2022-2064](https://cve.now/CVE-2022-2064.md): Insufficient Session Expiration in nocodb/nocodb (CVSS 9.1)
- [CVE-2022-2063](https://cve.now/CVE-2022-2063.md): Improper Privilege Management in nocodb/nocodb (CVSS 9.0)
- [CVE-2022-2062](https://cve.now/CVE-2022-2062.md): Generation of Error Message Containing Sensitive Information in nocodb/nocodb (CVSS 9.1)
- [CVE-2022-2022](https://cve.now/CVE-2022-2022.md): Cross-site Scripting (XSS) - Stored in nocodb/nocodb (CVSS 9.0)
- [CVE-2022-22121](https://cve.now/CVE-2022-22121.md): NocoDB - CSV Injection in User Management (CVSS 8.0)
- [CVE-2022-22120](https://cve.now/CVE-2022-22120.md): NocoDB - Observable Discrepancy in the password-reset feature (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nocodb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.