Priority HIGH 72
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.08875 · Published 2023-06-19 · No fix listed CWE-22
Priority HIGH 66
NocoDB is software for building databases as spreadsheets.
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00606 · Published 2024-05-13 · Fixed in 0.202.9 CWE-79
Priority MEDIUM 62
NocoDB is software for building databases as spreadsheets.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.0022 · Published 2026-01-28 · Fixed in 0.301.0 CWE-918
Priority MEDIUM 62
Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00773 · Published 2023-09-21 · Fixed in 0.96.0 CWE-20
Priority MEDIUM 60
NocoDB is software for building databases as spreadsheets.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00711 · Published 2025-03-06 · Fixed in 0.258.0 CWE-79
Priority MEDIUM 59
NocoDB is software for building databases as spreadsheets.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00574 · Published 2024-05-13 · Fixed in 0.202.10 CWE-434
Priority MEDIUM 41
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01243 · Published 2022-06-13 · Fixed in 0.91.7+, 0.91.9 CWE-613
Priority MEDIUM 41
Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01393 · Published 2022-06-13 · Fixed in 0.91.7+, 0.91.8 CWE-269
Priority LOW 39
NocoDB is software for building databases as spreadsheets.
CVSS 4.0HIGH 8.5· Network · Low privileges · User interaction · EPSS 0.00433 · Published 2026-01-28 · Fixed in 0.301.0 CWE-434
Priority LOW 37
In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection).
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.0125 · Published 2022-01-10 · No fix listed CWE-1236
Priority LOW 37
With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01858 · Published 2022-07-07 · Fixed in 0.92.0 CWE-918
Priority LOW 36
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.0229 · Published 2022-10-07 · Fixed in 0.92.0 CWE-770
Priority LOW 36
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01499 · Published 2022-06-13 · Fixed in 0.91.7+, 0.91.7 CWE-209
Priority LOW 32
NocoDB is software for building databases as spreadsheets.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00696 · Published 2024-05-13 · Fixed in 0.202.10 CWE-89
Priority LOW 32
Nocodb is an open source Airtable alternative.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00873 · Published 2023-10-17 · Fixed in 0.111.0 CWE-89
Priority LOW 30
NocoDB is software for building databases as spreadsheets.
CVSS 4.0MEDIUM 6.2· Network · Low privileges · No interaction · EPSS 0.00362 · Published 2026-03-02 · Fixed in 0.301.3 CWE-89
Priority LOW 27
In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01412 · Published 2022-01-10 · No fix listed CWE-203
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00724 · Published 2022-06-14 · Fixed in 0.91.7+, 0.91.9 CWE-79
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00825 · Published 2022-06-07 · Fixed in 0.91.7 CWE-79
Priority LOW 25
NocoDB is software for building databases as spreadsheets.
CVSS 4.0MEDIUM 5.7· Network · Low privileges · No interaction · EPSS 0.00306 · Published 2026-01-28 · Fixed in 0.301.0 CWE-601
Priority LOW 23
NocoDB is software for building databases as spreadsheets.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00206 · Published 2026-03-02 · Fixed in 0.301.3 CWE-79
Priority LOW 23
NocoDB is software for building databases as spreadsheets.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.0017 · Published 2026-03-02 · Fixed in 0.301.3 CWE-79
Priority LOW 23
NocoDB is software for building databases as spreadsheets.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00206 · Published 2026-03-02 · Fixed in 0.301.3 CWE-79
Priority LOW 23
NocoDB is software for building databases as spreadsheets.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00175 · Published 2026-03-02 · Fixed in 0.301.3 CWE-79
Priority LOW 23
NocoDB is software for building databases as spreadsheets.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.0017 · Published 2026-03-02 · Fixed in 0.301.3 CWE-79
Load more
THREATIST.IORead the docs