Vulnerabilities

Filters

1 selected

61 records

Sort

Vendor: nocodb Clear all filters

TI-2026-84857 CVE-2026-121736 · GHSA-mc8q-8prc-j4hf

Missing authentication in NocoDB lets attackers create OAuth codes

LOW 30

NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00297 Published 2026-11-03 Fixed in 2026.08.0 CWE-306

TI-2026-83190 CVE-2026-119715 · GHSA-2jgj-7q9p-vq8v

Clickjacking in NocoDB lets malicious pages trick signed-in users

LOW 23

NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00216 Published 2026-10-30 Fixed in 2026.08.0 CWE-1021

TI-2026-34226 CVE-2026-46547 · GHSA-9qgr-6vpg-9gh9

NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

LOW 27

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00265 Published 2026-06-23 Fixed in 2026.04.1 CWE-79

TI-2026-34227 CVE-2026-46548 · GHSA-2c5x-4jgf-88mj

NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)

LOW 20

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-06-23 Fixed in 2026.04.1 CWE-918

TI-2026-34228 CVE-2026-46549 · GHSA-m5qg-rvjq-727p

NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

LOW 10

NocoDB is software for building databases as spreadsheets.

CVSS 3.1LOW 2.0 Network High privileges User interaction EPSS 0.00241 Published 2026-06-23 Fixed in 2026.04.1 CWE-863

TI-2026-34229 CVE-2026-46550 · GHSA-f74w-272x-mqcv

NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags

LOW 24

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00159 Published 2026-06-23 Fixed in 2026.04.1 CWE-614

TI-2026-34231 CVE-2026-46552 · GHSA-chqv-vrj7-qffp

NocoDB: Shared-base link access can invite arbitrary users as persistent base members

LOW 32

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00313 Published 2026-06-23 Fixed in 2026.04.1 CWE-285

TI-2026-34232 CVE-2026-46553 · GHSA-8rwr-f68v-cvw6

NocoDB: Attachment Size Limit Bypass via Upload-by-URL

LOW 11

NocoDB is software for building databases as spreadsheets.

CVSS 4.0LOW 2.1 Network Low privileges No interaction EPSS 0.00406 Published 2026-06-23 Fixed in 2026.04.1 CWE-770

TI-2026-34945 CVE-2026-47375 · GHSA-cxv7-gmmp-228p

NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`

MEDIUM 60

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00376 Published 2026-06-23 Fixed in 2026.04.1 CWE-89

TI-2026-34946 CVE-2026-47376 · GHSA-6xcx-7qmg-vjfq

NocoDB: Reflected Cross-Site Scripting via Password Reset Token

LOW 24

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00444 Published 2026-06-23 Fixed in 2026.04.1 CWE-79

TI-2026-34947 CVE-2026-47377 · GHSA-rvp5-9p55-f5rp

NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin

LOW 23

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00406 Published 2026-06-23 Fixed in 2026.04.1 CWE-601

TI-2026-34948 CVE-2026-47378 · GHSA-4w6r-5c2j-qf5f

NocoDB: Hidden Column Exposure in Public Shared View Endpoints

LOW 33

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00406 Published 2026-06-23 Fixed in 2026.04.1 CWE-639

TI-2026-34950 CVE-2026-47380 · GHSA-jr54-jwhj-55gp

NocoDB: User Enumeration via Sign-In Timing

LOW 28

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00314 Published 2026-06-23 Fixed in 2026.04.1 CWE-208

TI-2026-34230 CVE-2026-46551 · GHSA-99vc-2jx2-688p

NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion

LOW 29

NocoDB is software for building databases as spreadsheets.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00411 Published 2026-06-23 Fixed in 2026.04.4 CWE-770

TI-2026-34233 CVE-2026-46554 · GHSA-f76x-f9vj-92jv

NocoDB: Stale Auth Cache After API Token Deletion

LOW 12

NocoDB is software for building databases as spreadsheets.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00314 Published 2026-06-23 Fixed in 2026.04.4 CWE-613

TI-2026-34952 CVE-2026-47382 · GHSA-w43h-r5m5-p832

NocoDB: Server-Side Request Forgery via Database Connection Host

LOW 30

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00351 Published 2026-06-23 Fixed in 2026.05.1 CWE-918

TI-2026-34858 CVE-2026-47279 · GHSA-9wgh-m22w-9xj8

NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints

LOW 37

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00406 Published 2026-06-23 Fixed in 2026.05.1 CWE-284

TI-2026-34949 CVE-2026-47379 · GHSA-qhxg-623c-cfjm

NocoDB: Plaintext Password Comparison in Shared Views

LOW 37

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00428 Published 2026-06-23 Fixed in 2026.05.1 CWE-200

TI-2026-34951 CVE-2026-47381 · GHSA-96fh-m4r8-6v9v

NocoDB: Cross-Workspace Integration Use in Connection Test

LOW 39

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0043 Published 2026-06-23 Fixed in 2026.05.1 CWE-290

TI-2026-34953 CVE-2026-47383 · GHSA-jf3g-4gwg-4h66

NocoDB: Stored Cross-Site Scripting via Row Comments

LOW 35

NocoDB is software for building databases as spreadsheets.

CVSS 4.0HIGH 7.4 Network Low privileges User interaction EPSS 0.00396 Published 2026-06-23 Fixed in 2026.05.1 CWE-79

TI-2026-34954 CVE-2026-47384 · GHSA-p8wx-5f39-w3x4

NocoDB: SQL Injection via Column Title in Bulk GroupBy

LOW 24

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00421 Published 2026-06-23 Fixed in 2026.05.1 CWE-89

TI-2026-34955 CVE-2026-47385 · GHSA-wvqj-9wv4-7ff5

NocoDB: Path Traversal via SQLite Source Filename

LOW 30

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00437 Published 2026-06-23 Fixed in 2026.05.1 CWE-22

TI-2026-34956 CVE-2026-47386 · GHSA-8m7c-hf24-5g47

NocoDB: OAuth Authorization Code Race Condition

LOW 28

NocoDB is software for building databases as spreadsheets.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00256 Published 2026-06-23 Fixed in 2026.05.1 CWE-362

TI-2026-34957 CVE-2026-47387 · GHSA-hj85-ph9q-78jg

NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

LOW 37

NocoDB is software for building databases as spreadsheets.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00396 Published 2026-06-23 Fixed in 2026.05.1 CWE-79

TI-2026-34958 CVE-2026-47388 · GHSA-xxpj-q764-9r6q

NocoDB: Missing Ownership Check in MCP Attachment Read

LOW 18

NocoDB is software for building databases as spreadsheets.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00271 Published 2026-06-23 Fixed in 2026.05.1 CWE-639