NocoDB is a lightweight, open-source database abstraction and no-code platform that presents a single, widely embedded product surface. Its vulnerability profile concentrates around web application input-handling and session-management weaknesses including cross-site scripting, SQL injection, server-side request forgery, and improper session expiration, reflecting the inherent risks of a web-facing database access layer. While the product has a modestly represented disclosure volume, it occupies a more prominent position in the landscape than its product count alone would suggest, driven by adoption in development and low-code deployment contexts where database connectivity and user-generated queries are central. The vulnerability exposure recurs around common web-tier weakness classes and file-upload handling, attack surfaces that are characteristic of applications bridging user interfaces directly to backend data stores. Current severity, exploitation activity, and detailed exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Nocodb over time
Signals from CVEs in this vendor scope (30 CVEs).
30 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-35843HIGH NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path para | Jun 19, 2023 | 7.5 | 36 | NO | YES |
CVE-2026-28358MEDIUM NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered email | Mar 2, 2026 | 5.3 | 30 | NO | YES |
CVE-2022-2063HIGH Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. | Jun 13, 2022 | 8.8 | 29 | NO | NO |
CVE-2026-28399HIGH NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit | Mar 2, 2026 | 8.8 | 28 | NO | NO |
CVE-2026-24769CRITICAL NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechan | Jan 28, 2026 | 9.0 | 28 | NO | NO |
CVE-2022-2064HIGH Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. | Jun 13, 2022 | 8.8 | 28 | NO | NO |
CVE-2025-27506MEDIUM NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /ap | Mar 6, 2025 | 6.1 | 27 | NO | YES |
CVE-2022-2062HIGH Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. | Jun 13, 2022 | 7.5 | 26 | NO | NO |
CVE-2022-22121HIGH In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in th | Jan 10, 2022 | 8.0 | 26 | NO | NO |
CVE-2022-2339HIGH With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information | Jul 7, 2022 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (30 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Nocodb.
Media articles that mention a CVE ID that affects a product developed by Nocodb — matched by CVE ID, not by vendor name.