{"schema_version":1,"title":"NocoDB vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in NocoDB: 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121736, was published on 3 November 2026. 4 vulnerabilities in the last four weeks, up 300% on the four before (1).","url":"https://junglewise.ai/threats/technologies/nocodb-nocodb","json_url":"https://junglewise.ai/threats/technologies/nocodb-nocodb.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/nocodb-nocodb","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":9,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":4,"last_90_days":5,"last_365_days":9},"latest":[{"cve":"CVE-2026-121736","cvss":5.3,"slug":"cve-2026-121736-nocodb-0-300-0-before-2026-08-0-contains-a-missing","title":"NocoDB missing authentication in OAuth authorize handler","severity":"medium","exploited":false,"published_at":"2026-11-03T23:17:37.73+00:00","url":"https://junglewise.ai/threats/cve-2026-121736-nocodb-0-300-0-before-2026-08-0-contains-a-missing"},{"cve":"CVE-2026-119715","cvss":4.3,"slug":"cve-2026-119715-nocodb-before-2026-08-0-contains-a-clickjacking-vulnerability","title":"NocoDB clickjacking vulnerability in authenticated interface","severity":"medium","exploited":false,"published_at":"2026-10-30T16:17:54.87+00:00","url":"https://junglewise.ai/threats/cve-2026-119715-nocodb-before-2026-08-0-contains-a-clickjacking-vulnerability"},{"cve":"CVE-2026-116120","cvss":5.6,"slug":"cve-2026-116120-a-vulnerability-was-determined-in-nocodb-up-to-2026-07-0-this","title":"NocoDB resource exhaustion in authentication endpoints","severity":"medium","exploited":false,"published_at":"2026-10-26T06:17:38.053+00:00","url":"https://junglewise.ai/threats/cve-2026-116120-a-vulnerability-was-determined-in-nocodb-up-to-2026-07-0-this"},{"cve":"CVE-2026-116119","cvss":5.5,"slug":"cve-2026-116119-a-vulnerability-was-found-in-nocodb-up-to-2026-08-0-this-affects","title":"NocoDB race condition in password-reset flow","severity":"medium","exploited":false,"published_at":"2026-10-26T05:17:54.55+00:00","url":"https://junglewise.ai/threats/cve-2026-116119-a-vulnerability-was-found-in-nocodb-up-to-2026-08-0-this-affects"},{"cve":"CVE-2026-88403","cvss":6.5,"epss":0.004,"slug":"cve-2026-88403-a-server-side-request-forgery-ssrf-in-the-serverrequest-function","title":"NocoDB serverRequest Server-Side Request Forgery","severity":"medium","exploited":false,"published_at":"2026-09-21T21:17:14.39+00:00","url":"https://junglewise.ai/threats/cve-2026-88403-a-server-side-request-forgery-ssrf-in-the-serverrequest-function"},{"cve":"CVE-2026-28399","cvss":4,"epss":0.0036,"slug":"cve-2026-28399-nocodb-sql-injection-in-dateadd-formula","title":"NocoDB Vulnerable to SQL Injection via DATEADD Formula","severity":"medium","exploited":false,"published_at":"2026-03-03T20:58:55+00:00","url":"https://junglewise.ai/threats/cve-2026-28399-nocodb-sql-injection-in-dateadd-formula"},{"cve":"CVE-2026-28361","cvss":4,"epss":0.0019,"slug":"cve-2026-28361-nocodb-missing-ownership-validation-in-mcp-token-operations","title":"NocoDB Missing Ownership Validation in MCP Token Operations","severity":"medium","exploited":false,"published_at":"2026-03-02T19:53:41+00:00","url":"https://junglewise.ai/threats/cve-2026-28361-nocodb-missing-ownership-validation-in-mcp-token-operations"},{"cve":"CVE-2026-28396","cvss":4,"epss":0.0021,"slug":"cve-2026-28396-nocodb-refresh-token-not-revoked-on-password-reset","title":"NocoDB's Refresh Tokens Not Revoked on Password Reset","severity":"medium","exploited":false,"published_at":"2026-03-02T19:53:17+00:00","url":"https://junglewise.ai/threats/cve-2026-28396-nocodb-refresh-token-not-revoked-on-password-reset"},{"cve":"CVE-2026-28360","cvss":4,"epss":0.0023,"slug":"cve-2026-28360-nocodb-plaintext-storage-of-shared-view-passwords","title":"NocoDB has Plaintext Storage of Shared View Passwords","severity":"medium","exploited":false,"published_at":"2026-03-02T19:52:57+00:00","url":"https://junglewise.ai/threats/cve-2026-28360-nocodb-plaintext-storage-of-shared-view-passwords"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"NocoDB","slug":"nocodb-nocodb","vendor":{"hub":true,"name":"NocoDB","slug":"nocodb","url":"https://junglewise.ai/threats/vendors/nocodb"},"aliases":[],"category":"database-platform","homepage":"https://nocodb.com","description":"Open-source database management platform providing spreadsheet-like interface to databases.","url":"https://junglewise.ai/threats/technologies/nocodb-nocodb"},"most_severe":[{"cve":"CVE-2026-88403","cvss":6.5,"epss":0.004,"slug":"cve-2026-88403-a-server-side-request-forgery-ssrf-in-the-serverrequest-function","title":"NocoDB serverRequest Server-Side Request Forgery","severity":"medium","exploited":false,"published_at":"2026-09-21T21:17:14.39+00:00","url":"https://junglewise.ai/threats/cve-2026-88403-a-server-side-request-forgery-ssrf-in-the-serverrequest-function"},{"cve":"CVE-2026-116120","cvss":5.6,"slug":"cve-2026-116120-a-vulnerability-was-determined-in-nocodb-up-to-2026-07-0-this","title":"NocoDB resource exhaustion in authentication endpoints","severity":"medium","exploited":false,"published_at":"2026-10-26T06:17:38.053+00:00","url":"https://junglewise.ai/threats/cve-2026-116120-a-vulnerability-was-determined-in-nocodb-up-to-2026-07-0-this"},{"cve":"CVE-2026-116119","cvss":5.5,"slug":"cve-2026-116119-a-vulnerability-was-found-in-nocodb-up-to-2026-08-0-this-affects","title":"NocoDB race condition in password-reset flow","severity":"medium","exploited":false,"published_at":"2026-10-26T05:17:54.55+00:00","url":"https://junglewise.ai/threats/cve-2026-116119-a-vulnerability-was-found-in-nocodb-up-to-2026-08-0-this-affects"},{"cve":"CVE-2026-121736","cvss":5.3,"slug":"cve-2026-121736-nocodb-0-300-0-before-2026-08-0-contains-a-missing","title":"NocoDB missing authentication in OAuth authorize handler","severity":"medium","exploited":false,"published_at":"2026-11-03T23:17:37.73+00:00","url":"https://junglewise.ai/threats/cve-2026-121736-nocodb-0-300-0-before-2026-08-0-contains-a-missing"},{"cve":"CVE-2026-119715","cvss":4.3,"slug":"cve-2026-119715-nocodb-before-2026-08-0-contains-a-clickjacking-vulnerability","title":"NocoDB clickjacking vulnerability in authenticated interface","severity":"medium","exploited":false,"published_at":"2026-10-30T16:17:54.87+00:00","url":"https://junglewise.ai/threats/cve-2026-119715-nocodb-before-2026-08-0-contains-a-clickjacking-vulnerability"},{"cve":"CVE-2026-28399","cvss":4,"epss":0.0036,"slug":"cve-2026-28399-nocodb-sql-injection-in-dateadd-formula","title":"NocoDB Vulnerable to SQL Injection via DATEADD Formula","severity":"medium","exploited":false,"published_at":"2026-03-03T20:58:55+00:00","url":"https://junglewise.ai/threats/cve-2026-28399-nocodb-sql-injection-in-dateadd-formula"},{"cve":"CVE-2026-28360","cvss":4,"epss":0.0023,"slug":"cve-2026-28360-nocodb-plaintext-storage-of-shared-view-passwords","title":"NocoDB has Plaintext Storage of Shared View Passwords","severity":"medium","exploited":false,"published_at":"2026-03-02T19:52:57+00:00","url":"https://junglewise.ai/threats/cve-2026-28360-nocodb-plaintext-storage-of-shared-view-passwords"},{"cve":"CVE-2026-28396","cvss":4,"epss":0.0021,"slug":"cve-2026-28396-nocodb-refresh-token-not-revoked-on-password-reset","title":"NocoDB's Refresh Tokens Not Revoked on Password Reset","severity":"medium","exploited":false,"published_at":"2026-03-02T19:53:17+00:00","url":"https://junglewise.ai/threats/cve-2026-28396-nocodb-refresh-token-not-revoked-on-password-reset"},{"cve":"CVE-2026-28361","cvss":4,"epss":0.0019,"slug":"cve-2026-28361-nocodb-missing-ownership-validation-in-mcp-token-operations","title":"NocoDB Missing Ownership Validation in MCP Token Operations","severity":"medium","exploited":false,"published_at":"2026-03-02T19:53:41+00:00","url":"https://junglewise.ai/threats/cve-2026-28361-nocodb-missing-ownership-validation-in-mcp-token-operations"}],"generated_at":"2026-11-11T03:07:00.183524+00:00"}