| CVE-2026-24768 | MITTEL6.1 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulnerability exists in NocoDB’s login flow due to missing validation of the `continueAfterSignIn` parameter. During authentication, NocoDB processes a user-controlled redirect value and conditio | 28/01/2026 |
| CVE-2026-24767 | MITTEL6.4 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metada | 28/01/2026 |
| CVE-2026-24766 | MITTEL4.9 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until server restart. While the pol | 28/01/2026 |
| CVE-2025-27506 | MITTEL6.1 | NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-si | 06/03/2025 |
| CVE-2023-50718 | MITTEL6.5 | NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch | 14/05/2024 |
| CVE-2023-50717 | MITTEL5.4 | NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote att | 14/05/2024 |
| CVE-2023-49781 | HOCH7.6 | NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the functi | 14/05/2024 |
| CVE-2023-43794 | MITTEL4.9 | Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can inject arbitrary SQL queries to be executed. | 17/10/2023 |
| CVE-2023-5104 | MITTEL6.5 | Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0. | 21/09/2023 |
| CVE-2022-3423 | MITTEL6.5 | Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. | 07/10/2022 |
| CVE-2022-2079 | MITTEL5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+. | 14/06/2022 |
| CVE-2022-2064 | HOCH8.8 | Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. | 13/06/2022 |
| CVE-2022-2063 | HOCH8.8 | Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. | 13/06/2022 |
| CVE-2022-2062 | HOCH7.5 | Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. | 13/06/2022 |