Nocodb vulnerabilities
60 CVEs and advisories name Nocodb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-53931NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
- CVE-2026-28401NocoDB: Stored Cross-Site Scripting via Rich Text Cells
- CVE-2026-28399NocoDB: SQL Injection via DATEADD Formula
- CVE-2026-28398NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells
- CVE-2026-28397NocoDB: Stored Cross-Site Scripting via Comments
- CVE-2026-28396NocoDB: Refresh Tokens Not Revoked on Password Reset
- CVE-2026-28361NocoDB: Missing Ownership Validation in MCP Token Operations
- CVE-2026-28360NocoDB: Plaintext Storage of Shared View Passwords
- CVE-2026-28359NocoDB: Stored Cross-Site Scripting via Rich Text Field
- CVE-2026-28358NocoDB: User Enumeration via Password Reset Endpoint
- CVE-2026-28357NocoDB: Stored Cross-Site Scripting via Formula Cell
- CVE-2026-24769NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
- CVE-2026-24768NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
- CVE-2026-24767NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
- CVE-2026-24766NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS
- CVE-2025-27506NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
- CVE-2023-49781NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue
- CVE-2023-50718NocoDB SQL Injection vulnerability
- CVE-2023-50717NocoDB Allows Preview of File with Dangerous Content
- CVE-2023-43794SQL Injection in nocodb
- CVE-2023-5104Improper Input Validation in nocodb/nocodb
- CVE-2022-3423Allocation of Resources Without Limits or Throttling in nocodb/nocodb
- CVE-2022-2339Server-Side Request Forgery (SSRF) in nocodb/nocodb
- CVE-2022-2079Cross-site Scripting (XSS) - Stored in nocodb/nocodb
- CVE-2022-2064Insufficient Session Expiration in nocodb/nocodb
- CVE-2022-2063Improper Privilege Management in nocodb/nocodb
- CVE-2022-2062Generation of Error Message Containing Sensitive Information in nocodb/nocodb
- CVE-2022-2022Cross-site Scripting (XSS) - Stored in nocodb/nocodb
- CVE-2022-22121NocoDB - CSV Injection in User Management
- CVE-2022-22120NocoDB - Observable Discrepancy in the password-reset feature