Vulnerabilities

TI-2026-22676 CVE-2026-28401 · GHSA-wwp2-x4rj-j8rm

NocoDB: Stored Cross-Site Scripting via Rich Text Cells

LOW 23

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00206 Published 2026-03-02 Fixed in 0.301.3 CWE-79

TI-2026-22674 CVE-2026-28399 · GHSA-45rp-9p97-h852

NocoDB: SQL Injection via DATEADD Formula

LOW 30

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.2 Network Low privileges No interaction EPSS 0.00362 Published 2026-03-02 Fixed in 0.301.3 CWE-89

TI-2026-22673 CVE-2026-28398 · GHSA-8vm4-g489-v3w7

NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells

LOW 23

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0017 Published 2026-03-02 Fixed in 0.301.3 CWE-79

TI-2026-22672 CVE-2026-28397 · GHSA-rcph-x7mj-54mm

NocoDB: Stored Cross-Site Scripting via Comments

LOW 23

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00206 Published 2026-03-02 Fixed in 0.301.3 CWE-79

TI-2026-22671 CVE-2026-28396 · GHSA-x4vh-j75g-268g

NocoDB: Refresh Tokens Not Revoked on Password Reset

LOW 22

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.0021 Published 2026-03-02 Fixed in 0.301.3 CWE-613

TI-2026-22641 CVE-2026-28361 · GHSA-p9x3-w98f-7j3q

NocoDB: Missing Ownership Validation in MCP Token Operations

LOW 22

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00185 Published 2026-03-02 Fixed in 0.301.3 CWE-639

TI-2026-22640 CVE-2026-28360 · GHSA-mpp2-x7wv-38hv

NocoDB: Plaintext Storage of Shared View Passwords

LOW 19

NocoDB is software for building databases as spreadsheets.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00226 Published 2026-03-02 Fixed in 0.301.3 CWE-256

TI-2026-22639 CVE-2026-28359 · GHSA-qxwq-q265-hc44

NocoDB: Stored Cross-Site Scripting via Rich Text Field

LOW 23

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00175 Published 2026-03-02 Fixed in 0.301.3 CWE-79

TI-2026-22638 CVE-2026-28358 · GHSA-387m-j3p9-3php

NocoDB: User Enumeration via Password Reset Endpoint

LOW 21

NocoDB is software for building databases as spreadsheets.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00651 Published 2026-03-02 Fixed in 0.301.3 CWE-204

TI-2026-22637 CVE-2026-28357 · GHSA-vx5p-q85x-xm3c

NocoDB: Stored Cross-Site Scripting via Formula Cell

LOW 23

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0017 Published 2026-03-02 Fixed in 0.301.3 CWE-79

TI-2026-19970 CVE-2026-24769 · GHSA-q5c6-h22r-qpwr

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

LOW 39

NocoDB is software for building databases as spreadsheets.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00433 Published 2026-01-28 Fixed in 0.301.0 CWE-434

TI-2026-19969 CVE-2026-24768 · GHSA-3hmw-8mw3-rmpj

NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter

LOW 25

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00306 Published 2026-01-28 Fixed in 0.301.0 CWE-601

TI-2026-19968 CVE-2026-24767 · GHSA-xr7v-j379-34v9

NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality

MEDIUM 62

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0022 Published 2026-01-28 Fixed in 0.301.0 CWE-918

TI-2026-19967 CVE-2026-24766 · GHSA-95ff-46g6-6gw9

NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS

LOW 23

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00423 Published 2026-01-28 Fixed in 0.301.0 CWE-1321

TI-2025-20338 CVE-2025-27506 · GHSA-wf6c-hrhf-86cw

NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

MEDIUM 60

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00711 Published 2025-03-06 Fixed in 0.258.0 CWE-79

TI-2023-27191 CVE-2023-49781 · GHSA-h6r4-xvw6-jc5h

NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

HIGH 66

NocoDB is software for building databases as spreadsheets.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00606 Published 2024-05-13 Fixed in 0.202.9 CWE-79

TI-2023-27664 CVE-2023-50718 · GHSA-8fxg-mr34-jqr8

NocoDB SQL Injection vulnerability

LOW 32

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00696 Published 2024-05-13 Fixed in 0.202.10 CWE-89

TI-2023-27663 CVE-2023-50717 · GHSA-qg73-g3cf-vhhh

NocoDB Allows Preview of File with Dangerous Content

MEDIUM 59

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00574 Published 2024-05-13 Fixed in 0.202.10 CWE-434

TI-2023-23485 CVE-2023-43794 · GHSA-3m5q-q39v-xf8f

SQL Injection in nocodb

LOW 32

Nocodb is an open source Airtable alternative.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00873 Published 2023-10-17 Fixed in 0.111.0 CWE-89

TI-2023-04694 CVE-2023-5104 · GHSA-xrpm-hccg-28x7

Improper Input Validation in nocodb/nocodb

MEDIUM 62

Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00773 Published 2023-09-21 Fixed in 0.96.0 CWE-20

TI-2023-17918 CVE-2023-35843 · GHSA-cjjg-rvc7-5p7r

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an…

HIGH 72

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08875 Published 2023-06-19 No fix listed CWE-22

TI-2022-03161 CVE-2022-3423 · GHSA-grv6-m753-3w2g

Allocation of Resources Without Limits or Throttling in nocodb/nocodb

LOW 36

Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.0229 Published 2022-10-07 Fixed in 0.92.0 CWE-770

TI-2022-02160 CVE-2022-2339 · GHSA-g2rq-gfm6-754j

Server-Side Request Forgery (SSRF) in nocodb/nocodb

LOW 37

With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01858 Published 2022-07-07 Fixed in 0.92.0 CWE-918

TI-2022-01924 CVE-2022-2079 · GHSA-hv6q-5g4f-8897

Cross-site Scripting (XSS) - Stored in nocodb/nocodb

LOW 26

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00724 Published 2022-06-14 Fixed in 0.91.7+, 0.91.9 CWE-79

TI-2022-01911 CVE-2022-2064 · GHSA-6293-2vg2-pmp5

Insufficient Session Expiration in nocodb/nocodb

MEDIUM 41

Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01243 Published 2022-06-13 Fixed in 0.91.7+, 0.91.9 CWE-613

Vulnerabilities

Filters