nocodb vulnerabilities

CVEs per yearBy the year they were published

1. 20229
2. 20232
3. 20243
4. 20251
5. 202645

Newest CVEs

• CVE-2026-121736

  NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation

  nocodb · nocodb

  Medium6.9
• CVE-2026-119715

  NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers

  nocodb · nocodb

  Medium5.3
• CVE-2026-46547

  NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

  nocodb · nocodb

  Medium6.1
• CVE-2026-46548

  NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)

  nocodb · nocodb

  Medium4.3
• CVE-2026-46549

  NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

  nocodb · nocodb

  Low2.0
• CVE-2026-46550

  NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags

  nocodb · nocodb

  Medium5.4
• CVE-2026-46552

  NocoDB: Shared-base link access can invite arbitrary users as persistent base members

  nocodb · nocodb

  Medium5.8
• CVE-2026-46553

  NocoDB: Attachment Size Limit Bypass via Upload-by-URL

  nocodb · nocodb

  Low2.1
• CVE-2026-47375

  NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`

  nocodb · nocodb

  Medium6.0
• CVE-2026-47376

  NocoDB: Reflected Cross-Site Scripting via Password Reset Token

  nocodb · nocodb

  Medium5.1