CVE-2026-53931 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP… |
CVE-2026-53930 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration wo… |
CVE-2026-53929 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, with NC_SECURE_ATTACHMENTS=true, an authenticated uploader could deliver .html o… |
CVE-2026-53928 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint… |
CVE-2026-53927 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path conta… |
CVE-2026-53926 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called fr… |
CVE-2026-47388 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read… |
CVE-2026-47387 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormVi… |
CVE-2026-47386 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code c… |
CVE-2026-47385 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source poi… |
CVE-2026-47384 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk… |
CVE-2026-47383 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as scr… |
CVE-2026-47382 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied databa… |
CVE-2026-47381 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through t… |
CVE-2026-47380 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses becau… |
CVE-2026-47379 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for… |
CVE-2026-47378 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had… |
CVE-2026-47377 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.replace() on a path e… |
CVE-2026-47376 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string… |
CVE-2026-47375 | Medium | 6.0 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can in… |
CVE-2026-47279 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID w… |
CVE-2026-46554 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry ex… |
CVE-2026-46553 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL path did not enforce NC_ATTACHMENT_FIELD_SIZE against either t… |
CVE-2026-46552 | Medium | 5.8 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, shared-base sessions were granted the same base-member capabilities as authentic… |
CVE-2026-46551 | Medium | 6.5 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_… |
CVE-2026-46550 | Medium | 5.4 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with httpOnly: true but missing both the secure… |
CVE-2026-46549 | Low | 2.0 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the… |
CVE-2026-46548 | Medium | 4.3 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notif… |
CVE-2026-46547 | Medium | 6.1 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, a reflected XSS vulnerability exists in the Page Leaving Warning page. The ncRed… |
CVE-2026-28401 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables st… |
CVE-2026-28399 | High | 8.8 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the D… |
CVE-2026-28398 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v… |
CVE-2026-28397 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This… |
CVE-2026-28396 | Medium | 6.5 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing a… |
CVE-2026-28361 | Medium | 6.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator… |
CVE-2026-28360 | Medium | 5.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compare… |
CVE-2026-28359 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich… |
CVE-2026-28358 | Medium | 5.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered a… |
CVE-2026-28357 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula res… |
CVE-2026-24769 | Critical | 9.0 | 2026-01-28 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attac… |
CVE-2026-24768 | Medium | 6.1 | 2026-01-28 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulnerability exists in NocoDB’s l… |
CVE-2026-24767 | Medium | 4.9 | 2026-01-28 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `up… |
CVE-2026-24766 | Medium | 4.9 | 2026-01-28 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit proto… |
CVE-2025-27506 | Medium | 5.4 | 2025-03-06 | NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Script… |
CVE-2023-50718 | Medium | 6.5 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injectio… |
CVE-2023-50717 | Medium | 5.7 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with ma… |
CVE-2023-49781 | High | 7.3 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell… |
CVE-2023-43794 | Medium | 6.5 | 2023-10-17 | Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with cr… |
CVE-2023-5104 | Medium | 6.5 | 2023-09-21 | Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0. |
CVE-2023-35843 | High | 7.5 | 2023-06-19 | NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manip… |
CVE-2022-3423 | High | 7.3 | 2022-10-07 | Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. |
CVE-2022-2339 | High | 7.5 | 2022-07-07 | With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of… |
CVE-2022-2079 | Medium | 5.4 | 2022-06-14 | Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2064 | High | 8.8 | 2022-06-13 | Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2063 | High | 8.8 | 2022-06-13 | Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2062 | High | 7.5 | 2022-06-13 | Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2022 | Medium | 5.4 | 2022-06-07 | Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7. |
CVE-2022-22121 | High | 8.0 | 2022-01-10 | In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to… |
CVE-2022-22120 | Medium | 5.3 | 2022-01-10 | In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email ad… |