{"schema_version":1,"title":"nocodb (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 55 vulnerabilities in nocodb (npm): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-53931, was published on 23 June 2026.","url":"https://junglewise.ai/threats/technologies/nocodb","json_url":"https://junglewise.ai/threats/technologies/nocodb.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/nocodb","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":55,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":44},"latest":[{"cve":"CVE-2026-53931","cvss":4,"epss":0.0041,"slug":"cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint","title":"NocoDB SSRF in spreadsheet-import endpoint","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:01.987+00:00","url":"https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint"},{"cve":"CVE-2026-53930","cvss":4,"epss":0.0039,"slug":"cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint","title":"NocoDB SSRF in base-migration endpoint","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:01.87+00:00","url":"https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint"},{"cve":"CVE-2026-53929","cvss":4,"epss":0.004,"slug":"cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments","title":"NocoDB stored cross-site scripting in secure attachments","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:01.743+00:00","url":"https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments"},{"cve":"CVE-2026-53928","cvss":4,"epss":0.0031,"slug":"cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow","title":"NocoDB insufficient session expiration in password recovery flow","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:01.623+00:00","url":"https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow"},{"cve":"CVE-2026-53927","cvss":4,"epss":0.0039,"slug":"cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint","title":"NocoDB SSRF in spreadsheet-fetch endpoint","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:01.497+00:00","url":"https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint"},{"cve":"CVE-2026-53926","cvss":4,"epss":0.0041,"slug":"cve-2026-53926-nocodb-insufficient-session-expiration-in-oauth-token-revocation","title":"NocoDB insufficient session expiration in OAuth token revocation","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:01.363+00:00","url":"https://junglewise.ai/threats/cve-2026-53926-nocodb-insufficient-session-expiration-in-oauth-token-revocation"},{"cve":"CVE-2026-47388","cvss":4,"epss":0.0027,"slug":"cve-2026-47388-nocodb-authorization-bypass-in-mcp-readattachment-tool","title":"NocoDB authorization bypass in MCP readAttachment tool","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:00.873+00:00","url":"https://junglewise.ai/threats/cve-2026-47388-nocodb-authorization-bypass-in-mcp-readattachment-tool"},{"cve":"CVE-2026-47387","cvss":4,"epss":0.004,"slug":"cve-2026-47387-nocodb-stored-xss-in-shared-form-view-redirect-url","title":"NocoDB stored XSS in shared form-view redirect URL","severity":"high","exploited":false,"published_at":"2026-06-23T21:17:00.743+00:00","url":"https://junglewise.ai/threats/cve-2026-47387-nocodb-stored-xss-in-shared-form-view-redirect-url"},{"cve":"CVE-2026-47386","cvss":4,"epss":0.0026,"slug":"cve-2026-47386-nocodb-oauth-authorization-code-race-condition","title":"NocoDB OAuth authorization code race condition","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:00.617+00:00","url":"https://junglewise.ai/threats/cve-2026-47386-nocodb-oauth-authorization-code-race-condition"},{"cve":"CVE-2026-47385","cvss":4,"epss":0.0044,"slug":"cve-2026-47385-nocodb-path-traversal-in-sqlite-source-integration","title":"NocoDB path traversal in SQLite source integration","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:00.487+00:00","url":"https://junglewise.ai/threats/cve-2026-47385-nocodb-path-traversal-in-sqlite-source-integration"},{"cve":"CVE-2026-47384","cvss":4,"epss":0.0042,"slug":"cve-2026-47384-nocodb-sql-injection-in-bulk-groupby-via-column-title","title":"NocoDB SQL injection in bulk groupBy via column title","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:00.357+00:00","url":"https://junglewise.ai/threats/cve-2026-47384-nocodb-sql-injection-in-bulk-groupby-via-column-title"},{"cve":"CVE-2026-47383","cvss":4,"epss":0.004,"slug":"cve-2026-47383-nocodb-stored-xss-in-row-comments","title":"NocoDB stored XSS in row comments","severity":"high","exploited":false,"published_at":"2026-06-23T21:17:00.2+00:00","url":"https://junglewise.ai/threats/cve-2026-47383-nocodb-stored-xss-in-row-comments"},{"cve":"CVE-2026-47382","cvss":4,"epss":0.0035,"slug":"cve-2026-47382-nocodb-server-side-request-forgery-in-connection-test-endpoint","title":"NocoDB Server-Side Request Forgery in connection-test endpoint","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:00.077+00:00","url":"https://junglewise.ai/threats/cve-2026-47382-nocodb-server-side-request-forgery-in-connection-test-endpoint"},{"cve":"CVE-2026-47381","cvss":4,"epss":0.0043,"slug":"cve-2026-47381-nocodb-authorization-bypass-in-testconnection-endpoint","title":"NocoDB authorization bypass in testConnection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:59.93+00:00","url":"https://junglewise.ai/threats/cve-2026-47381-nocodb-authorization-bypass-in-testconnection-endpoint"},{"cve":"CVE-2026-47380","cvss":4,"epss":0.0031,"slug":"cve-2026-47380-nocodb-user-enumeration-via-sign-in-timing-discrepancy","title":"NocoDB user enumeration via sign-in timing discrepancy","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:59.803+00:00","url":"https://junglewise.ai/threats/cve-2026-47380-nocodb-user-enumeration-via-sign-in-timing-discrepancy"},{"cve":"CVE-2026-47379","cvss":4,"epss":0.0043,"slug":"cve-2026-47379-nocodb-timing-attack-in-shared-view-password-check","title":"NocoDB timing attack in shared-view password check","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:59.677+00:00","url":"https://junglewise.ai/threats/cve-2026-47379-nocodb-timing-attack-in-shared-view-password-check"},{"cve":"CVE-2026-47378","cvss":4,"epss":0.0041,"slug":"cve-2026-47378-nocodb-information-disclosure-in-public-shared-view-endpoints","title":"NocoDB information disclosure in public shared-view endpoints","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:59.557+00:00","url":"https://junglewise.ai/threats/cve-2026-47378-nocodb-information-disclosure-in-public-shared-view-endpoints"},{"cve":"CVE-2026-47377","cvss":4,"epss":0.0041,"slug":"cve-2026-47377-nocodb-open-redirect-in-hashredirect-plugin","title":"NocoDB open redirect in hashRedirect plugin","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:59.413+00:00","url":"https://junglewise.ai/threats/cve-2026-47377-nocodb-open-redirect-in-hashredirect-plugin"},{"cve":"CVE-2026-47376","cvss":4,"epss":0.0044,"slug":"cve-2026-47376-nocodb-reflected-xss-in-password-reset-page","title":"NocoDB reflected XSS in password-reset page","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:59.28+00:00","url":"https://junglewise.ai/threats/cve-2026-47376-nocodb-reflected-xss-in-password-reset-page"},{"cve":"CVE-2026-47375","cvss":6,"epss":0.0038,"slug":"cve-2026-47375-nocodb-sql-injection-in-arraysort-formula-for-postgresql","title":"NocoDB SQL injection in ARRAYSORT formula for PostgreSQL","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:59.087+00:00","url":"https://junglewise.ai/threats/cve-2026-47375-nocodb-sql-injection-in-arraysort-formula-for-postgresql"},{"cve":"CVE-2026-47279","cvss":4,"epss":0.0041,"slug":"cve-2026-47279-nocodb-improper-access-control-in-public-shared-view-relation","title":"NocoDB improper access control in public shared-view relation endpoints","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.953+00:00","url":"https://junglewise.ai/threats/cve-2026-47279-nocodb-improper-access-control-in-public-shared-view-relation"},{"cve":"CVE-2026-46554","cvss":4,"epss":0.0031,"slug":"cve-2026-46554-nocodb-stale-authentication-cache-after-api-token-deletion","title":"NocoDB stale authentication cache after API token deletion","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.83+00:00","url":"https://junglewise.ai/threats/cve-2026-46554-nocodb-stale-authentication-cache-after-api-token-deletion"},{"cve":"CVE-2026-46553","cvss":4,"epss":0.0041,"slug":"cve-2026-46553-nocodb-attachment-size-limit-bypass-in-upload-by-url","title":"NocoDB attachment size limit bypass in upload-by-URL","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.71+00:00","url":"https://junglewise.ai/threats/cve-2026-46553-nocodb-attachment-size-limit-bypass-in-upload-by-url"},{"cve":"CVE-2026-46552","cvss":5.8,"epss":0.0031,"slug":"cve-2026-46552-nocodb-improper-authorization-in-shared-base-sessions","title":"NocoDB improper authorization in shared-base sessions","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.583+00:00","url":"https://junglewise.ai/threats/cve-2026-46552-nocodb-improper-authorization-in-shared-base-sessions"},{"cve":"CVE-2026-46551","cvss":6.5,"epss":0.0041,"slug":"cve-2026-46551-nocodb-denial-of-service-via-disk-exhaustion-in-attachment-api","title":"NocoDB denial of service via disk exhaustion in attachment API","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.457+00:00","url":"https://junglewise.ai/threats/cve-2026-46551-nocodb-denial-of-service-via-disk-exhaustion-in-attachment-api"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"flowise (npm)","slug":"flowise","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/budibase-server"},{"name":"directus (npm)","slug":"directus","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"hono (npm)","slug":"hono","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"dompurify (npm)","slug":"dompurify","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/dompurify"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"flowise-components (npm)","slug":"flowise-components","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/flowise-components"},{"name":"astro (npm)","slug":"astro","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/astro"},{"name":"@anthropic-ai/claude-code (npm)","slug":"anthropic-ai-claude-code","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/anthropic-ai-claude-code"},{"name":"9router (npm)","slug":"9router","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/9router"}],"technology":{"hub":true,"name":"nocodb (npm)","slug":"nocodb","vendor":{"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://nocodb.com/","repo_url":"https://github.com/nocodb/nocodb","description":"An open-source no-code database platform that turns any database into a smart spreadsheet.","url":"https://junglewise.ai/threats/technologies/nocodb"},"most_severe":[{"cve":"CVE-2026-47387","cvss":4,"epss":0.004,"slug":"cve-2026-47387-nocodb-stored-xss-in-shared-form-view-redirect-url","title":"NocoDB stored XSS in shared form-view redirect URL","severity":"high","exploited":false,"published_at":"2026-06-23T21:17:00.743+00:00","url":"https://junglewise.ai/threats/cve-2026-47387-nocodb-stored-xss-in-shared-form-view-redirect-url"},{"cve":"CVE-2026-47383","cvss":4,"epss":0.004,"slug":"cve-2026-47383-nocodb-stored-xss-in-row-comments","title":"NocoDB stored XSS in row comments","severity":"high","exploited":false,"published_at":"2026-06-23T21:17:00.2+00:00","url":"https://junglewise.ai/threats/cve-2026-47383-nocodb-stored-xss-in-row-comments"},{"cve":"CVE-2026-46551","cvss":6.5,"epss":0.0041,"slug":"cve-2026-46551-nocodb-denial-of-service-via-disk-exhaustion-in-attachment-api","title":"NocoDB denial of service via disk exhaustion in attachment API","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.457+00:00","url":"https://junglewise.ai/threats/cve-2026-46551-nocodb-denial-of-service-via-disk-exhaustion-in-attachment-api"},{"cvss":6.3,"slug":"nocodb-insufficient-session-expiration-for-oauth-tokens-89010bea","title":"NocoDB insufficient session expiration for OAuth tokens","severity":"medium","exploited":false,"published_at":"2026-06-05T16:43:09+00:00","url":"https://junglewise.ai/threats/nocodb-insufficient-session-expiration-for-oauth-tokens-89010bea"},{"cve":"CVE-2026-46547","cvss":6.1,"epss":0.0027,"slug":"cve-2026-46547-nocodb-reflected-xss-in-page-leaving-warning-page","title":"NocoDB reflected XSS in Page Leaving Warning page","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:57.94+00:00","url":"https://junglewise.ai/threats/cve-2026-46547-nocodb-reflected-xss-in-page-leaving-warning-page"},{"cve":"CVE-2026-47375","cvss":6,"epss":0.0038,"slug":"cve-2026-47375-nocodb-sql-injection-in-arraysort-formula-for-postgresql","title":"NocoDB SQL injection in ARRAYSORT formula for PostgreSQL","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:59.087+00:00","url":"https://junglewise.ai/threats/cve-2026-47375-nocodb-sql-injection-in-arraysort-formula-for-postgresql"},{"cve":"CVE-2026-46552","cvss":5.8,"epss":0.0031,"slug":"cve-2026-46552-nocodb-improper-authorization-in-shared-base-sessions","title":"NocoDB improper authorization in shared-base sessions","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.583+00:00","url":"https://junglewise.ai/threats/cve-2026-46552-nocodb-improper-authorization-in-shared-base-sessions"},{"cve":"CVE-2026-46550","cvss":5.4,"epss":0.0016,"slug":"cve-2026-46550-nocodb-missing-secure-and-samesite-flags-in-refresh-token-cookie","title":"NocoDB missing Secure and SameSite flags in refresh-token cookie","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.323+00:00","url":"https://junglewise.ai/threats/cve-2026-46550-nocodb-missing-secure-and-samesite-flags-in-refresh-token-cookie"},{"cve":"CVE-2026-46548","cvss":4.3,"epss":0.0029,"slug":"cve-2026-46548-nocodb-ssrf-protection-bypass-in-notification-webhook-plugins","title":"NocoDB SSRF protection bypass in notification webhook plugins","severity":"medium","exploited":false,"published_at":"2026-06-23T21:16:58.077+00:00","url":"https://junglewise.ai/threats/cve-2026-46548-nocodb-ssrf-protection-bypass-in-notification-webhook-plugins"},{"cve":"CVE-2026-28358","cvss":4,"epss":0.0072,"slug":"cve-2026-28358-nocodb-user-enumeration-in-password-reset-endpoint","title":"NocoDB user enumeration via password reset endpoint","severity":"medium","exploited":false,"published_at":"2026-03-02T19:42:07+00:00","url":"https://junglewise.ai/threats/cve-2026-28358-nocodb-user-enumeration-in-password-reset-endpoint"}],"generated_at":"2026-09-26T10:14:00.201383+00:00"}