CVE Tools
Track your stack

Nocodb

44 CVEs tracked since 2022. Since Jun 2022, none of them reached CISA KEV.

Nocodb CVEs per month

Jun 2022 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Nocodb CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2022-0650
2022-073 or fewer
2022-083 or fewer
2022-093 or fewer
2022-102 or fewer
2022-113 or fewer
2022-123 or fewer
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-03100
2026-046 or fewer
2026-057 or fewer
2026-06290
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Nocodb's monthly top three, with their CVEs summed over those months.

  1. Nocodb443 months
  2. Nocodb/nocodb51 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Nocodb.

  1. CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL6.1
  2. CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)4.3
  3. CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation2.0
  4. CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags5.4
  5. CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base members5.8
  6. CVE-2026-46553NocoDB: Attachment Size Limit Bypass via Upload-by-URL—
  7. CVE-2026-47375NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`6.0
  8. CVE-2026-47376NocoDB: Reflected Cross-Site Scripting via Password Reset Token—
  9. CVE-2026-47377NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin—
  10. CVE-2026-47378NocoDB: Hidden Column Exposure in Public Shared View Endpoints—
  11. CVE-2026-47380NocoDB: User Enumeration via Sign-In Timing—
  12. CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion6.5
  13. CVE-2026-46554NocoDB: Stale Auth Cache After API Token Deletion—
  14. CVE-2026-47382NocoDB: Server-Side Request Forgery via Database Connection Host—
  15. CVE-2026-47279NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints—

The record

Peak rank
#29 in Jun 2026
Busiest month shown
Jun 2026, 29 CVEs
Months with a KEV entry
0 since Jun 2022
Monthly snapshots
3 since 2022
Nocodb's full record, month by month