nocodb

Records61All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

nocodb records in CISA KEV

No nocodb vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Nocodb 30 records HIGH

Records

61 records

TI-2023-17918 CVE-2023-35843 · GHSA-cjjg-rvc7-5p7r

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an…

HIGH 72

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08875 Published 2023-06-19 No fix listed CWE-22

TI-2023-27191 CVE-2023-49781 · GHSA-h6r4-xvw6-jc5h

NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

HIGH 66

NocoDB is software for building databases as spreadsheets.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00606 Published 2024-05-13 Fixed in 0.202.9 CWE-79

TI-2026-19968 CVE-2026-24767 · GHSA-xr7v-j379-34v9

NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality

MEDIUM 62

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0022 Published 2026-01-28 Fixed in 0.301.0 CWE-918

TI-2023-04694 CVE-2023-5104 · GHSA-xrpm-hccg-28x7

Improper Input Validation in nocodb/nocodb

MEDIUM 62

Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00773 Published 2023-09-21 Fixed in 0.96.0 CWE-20

TI-2026-34945 CVE-2026-47375 · GHSA-cxv7-gmmp-228p

NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`

MEDIUM 60

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00376 Published 2026-06-23 Fixed in 2026.04.1 CWE-89

TI-2025-20338 CVE-2025-27506 · GHSA-wf6c-hrhf-86cw

NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

MEDIUM 60

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00711 Published 2025-03-06 Fixed in 0.258.0 CWE-79

TI-2023-27663 CVE-2023-50717 · GHSA-qg73-g3cf-vhhh

NocoDB Allows Preview of File with Dangerous Content

MEDIUM 59

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00574 Published 2024-05-13 Fixed in 0.202.10 CWE-434

TI-2022-01911 CVE-2022-2064 · GHSA-6293-2vg2-pmp5

Insufficient Session Expiration in nocodb/nocodb

MEDIUM 41

Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01243 Published 2022-06-13 Fixed in 0.91.7+, 0.91.9 CWE-613

TI-2022-01910 CVE-2022-2063 · GHSA-fq4h-m3c8-8m2v

Improper Privilege Management in nocodb/nocodb

MEDIUM 41

Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01393 Published 2022-06-13 Fixed in 0.91.7+, 0.91.8 CWE-269

TI-2026-38902 CVE-2026-53931 · GHSA-hmcr-rmjq-47qr

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

LOW 39

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00406 Published 2026-06-23 Fixed in 2026.05.1 CWE-441

TI-2026-34951 CVE-2026-47381 · GHSA-96fh-m4r8-6v9v

NocoDB: Cross-Workspace Integration Use in Connection Test

LOW 39

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0043 Published 2026-06-23 Fixed in 2026.05.1 CWE-290

TI-2026-19970 CVE-2026-24769 · GHSA-q5c6-h22r-qpwr

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

LOW 39

NocoDB is software for building databases as spreadsheets.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00433 Published 2026-01-28 Fixed in 0.301.0 CWE-434

TI-2026-34957 CVE-2026-47387 · GHSA-hj85-ph9q-78jg

NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

LOW 37

NocoDB is software for building databases as spreadsheets.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00396 Published 2026-06-23 Fixed in 2026.05.1 CWE-79

TI-2026-34949 CVE-2026-47379 · GHSA-qhxg-623c-cfjm

NocoDB: Plaintext Password Comparison in Shared Views

LOW 37

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00428 Published 2026-06-23 Fixed in 2026.05.1 CWE-200

TI-2026-34858 CVE-2026-47279 · GHSA-9wgh-m22w-9xj8

NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints

LOW 37

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00406 Published 2026-06-23 Fixed in 2026.05.1 CWE-284

TI-2022-06466 CVE-2022-22121 · GHSA-6gjq-vmwg-37pv

NocoDB - CSV Injection in User Management

LOW 37

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection).

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.0125 Published 2022-01-10 No fix listed CWE-1236

TI-2022-02160 CVE-2022-2339 · GHSA-g2rq-gfm6-754j

Server-Side Request Forgery (SSRF) in nocodb/nocodb

LOW 37

With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01858 Published 2022-07-07 Fixed in 0.92.0 CWE-918

TI-2022-03161 CVE-2022-3423 · GHSA-grv6-m753-3w2g

Allocation of Resources Without Limits or Throttling in nocodb/nocodb

LOW 36

Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.0229 Published 2022-10-07 Fixed in 0.92.0 CWE-770

TI-2022-01909 CVE-2022-2062 · GHSA-mx8q-jqwm-85mv

Generation of Error Message Containing Sensitive Information in nocodb/nocodb

LOW 36

Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01499 Published 2022-06-13 Fixed in 0.91.7+, 0.91.7 CWE-209

TI-2026-34953 CVE-2026-47383 · GHSA-jf3g-4gwg-4h66

NocoDB: Stored Cross-Site Scripting via Row Comments

LOW 35

NocoDB is software for building databases as spreadsheets.

CVSS 4.0HIGH 7.4 Network Low privileges User interaction EPSS 0.00396 Published 2026-06-23 Fixed in 2026.05.1 CWE-79

TI-2026-34948 CVE-2026-47378 · GHSA-4w6r-5c2j-qf5f

NocoDB: Hidden Column Exposure in Public Shared View Endpoints

LOW 33

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00406 Published 2026-06-23 Fixed in 2026.04.1 CWE-639

TI-2026-34231 CVE-2026-46552 · GHSA-chqv-vrj7-qffp

NocoDB: Shared-base link access can invite arbitrary users as persistent base members

LOW 32

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00313 Published 2026-06-23 Fixed in 2026.04.1 CWE-285

TI-2023-27664 CVE-2023-50718 · GHSA-8fxg-mr34-jqr8

NocoDB SQL Injection vulnerability

LOW 32

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00696 Published 2024-05-13 Fixed in 0.202.10 CWE-89

TI-2023-23485 CVE-2023-43794 · GHSA-3m5q-q39v-xf8f

SQL Injection in nocodb

LOW 32

Nocodb is an open source Airtable alternative.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00873 Published 2023-10-17 Fixed in 0.111.0 CWE-89

TI-2026-84857 CVE-2026-121736 · GHSA-mc8q-8prc-j4hf

Missing authentication in NocoDB lets attackers create OAuth codes

LOW 30

NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00297 Published 2026-11-03 Fixed in 2026.08.0 CWE-306

Open these records in search →