nocodb vulnerabilities
CVEs whose affected-version data names the nocodb package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-53927MediumNocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
▾ Sunlitnocodb · nocodbEPSS 0.39%via GHSA
CVE-2026-53928MediumNocoDB: Refresh Tokens Persist Through Password Recovery
NocoDB: Refresh Tokens Persist Through Password Recovery
▾ Sunlitnocodb · nocodbEPSS 0.31%via GHSA
CVE-2026-53929MediumNocoDB: Stored Cross-Site Scripting via Secure Attachment
NocoDB: Stored Cross-Site Scripting via Secure Attachment
▾ Sunlitnocodb · nocodbEPSS 0.40%via GHSA
CVE-2026-53930MediumNocoDB: Server-Side Request Forgery via Base Migration URL
NocoDB: Server-Side Request Forgery via Base Migration URL
▾ Sunlitnocodb · nocodbEPSS 0.39%via GHSA
CVE-2026-53931MediumNocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
▾ Sunlitnocodb · nocodbEPSS 0.41%via GHSA