CVE-2026-28401

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html wi

5.4MEDIUM

CVE-2026-28399

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can i

8.8HIGH

CVE-2026-28398

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich

5.4MEDIUM

CVE-2026-28397

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitiza

5.4MEDIUM

CVE-2026-28396

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existi

6.5MEDIUM

CVE-2026-28361

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token

6.3MEDIUM

CVE-2026-28360

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintex

5.3MEDIUM

CVE-2026-28359

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can in

5.4MEDIUM

CVE-2026-28358

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned differe

5.3MEDIUM

CVE-2026-28357

< 0.301.3

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Form

5.4MEDIUM

CVE-2026-24769

< 0.301.0

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerabi

9.0CRITICAL

CVE-2026-24768

< 0.301.0

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulne

6.1MEDIUM

CVE-2026-24767

< 0.301.0

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vu

4.9MEDIUM

CVE-2026-24766

< 0.301.0

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator

4.9MEDIUM

CVE-2025-27506

< 0.258.0

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable t

5.4MEDIUM

CVE-2023-50718

< 0.202.10

NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access

6.5MEDIUM

CVE-2023-50717

>= 0.202.6 and < 0.202.10

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker c

5.7MEDIUM

CVE-2023-49781

< 0.202.9

NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists wi

7.3HIGH

CVE-2023-43794

all versions

Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an a

6.5MEDIUM

CVE-2023-5104

< 0.96.0

Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.

6.5MEDIUM

CVE-2023-35843

<= 0.106.1

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary

7.5HIGH

CVE-2022-3423

< 0.92.0

Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.

7.3HIGH

CVE-2022-2339

< 0.92.0

With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. Thi

7.5HIGH

CVE-2022-2079

< 0.91.7

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.

5.4MEDIUM

CVE-2022-2064

< 0.91.7

Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.

8.8HIGH

CVE-2022-2063

< 0.91.7

Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.

8.8HIGH

CVE-2022-2062

< 0.91.7

Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.

7.5HIGH

CVE-2022-2022

< 0.91.7

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7.

5.4MEDIUM

CVE-2022-22121

>= 0.81.0 and <= 0.83.8

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attack

8.0HIGH

CVE-2022-22120

>= 0.9 and <= 0.83.8

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a passwo

5.3MEDIUM