Search vulnerabilities

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2026-126272

NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints

NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126273

NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap

NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126274

NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126275

NocoDB before 2026.09.0 IDOR in Row Comment Operations

NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126276

NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange

NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret.

CVSS 4.0 · 8.2 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126277

NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API

NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126278

NocoDB before 2026.08.1 Password Reset Token Race Condition

NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126279

NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip

NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victims open the field configuration, stealing the localStorage session token to call authenticated APIs as the victim.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126280

NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation

NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126281

NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy

NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126282

NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update

NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126283

NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens

NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126284

NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch

NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126285

NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter

NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.

CVSS 4.0 · 8.3 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126286

NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue

NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126287

NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition

NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection.

CVSS 4.0 · 6 Medium EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126288

NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint

NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126289

NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts

NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126290

NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read

NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126291

NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query

NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb