CVE Tools
Track your stack

Nocodb

44 CVEs tracked since 2022. Since Jun 2022, none of them reached CISA KEV.

Nocodb CVEs per month

Jun 2022 to Jun 2026. Point at a month, or focus the strip and use the arrow keys.
Nocodb CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2022-0650
2022-07null or fewer
2022-08null or fewer
2022-09null or fewer
2022-10null or fewer
2022-11null or fewer
2022-12null or fewer
2023-01null or fewer
2023-02null or fewer
2023-03null or fewer
2023-04null or fewer
2023-05null or fewer
2023-06null or fewer
2023-07null or fewer
2023-08null or fewer
2023-09null or fewer
2023-10null or fewer
2023-11null or fewer
2023-12null or fewer
2024-01null or fewer
2024-02null or fewer
2024-03null or fewer
2024-04null or fewer
2024-05null or fewer
2024-06null or fewer
2024-07null or fewer
2024-08null or fewer
2024-09null or fewer
2024-10null or fewer
2024-11null or fewer
2024-12null or fewer
2025-01null or fewer
2025-02null or fewer
2025-03null or fewer
2025-04null or fewer
2025-05null or fewer
2025-06null or fewer
2025-07null or fewer
2025-08null or fewer
2025-09null or fewer
2025-10null or fewer
2025-11null or fewer
2025-12null or fewer
2026-01null or fewer
2026-02null or fewer
2026-03100
2026-04null or fewer
2026-05null or fewer
2026-06290

Products

The products that kept showing up in Nocodb's monthly top three, with their CVEs summed over those months.

  1. Nocodb443 months
  2. Nocodb/nocodb51 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Nocodb.

  1. CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL6.1
  2. CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)4.3
  3. CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation2.0
  4. CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags5.4
  5. CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base members5.8
  6. CVE-2026-46553NocoDB: Attachment Size Limit Bypass via Upload-by-URL—
  7. CVE-2026-47375NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`6.0
  8. CVE-2026-47376NocoDB: Reflected Cross-Site Scripting via Password Reset Token—
  9. CVE-2026-47377NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin—
  10. CVE-2026-47378NocoDB: Hidden Column Exposure in Public Shared View Endpoints—
  11. CVE-2026-47380NocoDB: User Enumeration via Sign-In Timing—
  12. CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion6.5
  13. CVE-2026-46554NocoDB: Stale Auth Cache After API Token Deletion—
  14. CVE-2026-47382NocoDB: Server-Side Request Forgery via Database Connection Host—
  15. CVE-2026-47279NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints—

The record

Peak rank
#29 in Jun 2026
Busiest month shown
Jun 2026, 29 CVEs
Months with a KEV entry
0 since Jun 2022
Monthly snapshots
3 since 2022
Nocodb's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store