Branches de versions concernées
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2026-126267 | NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging | ≥ 0.300.0 < 2026.04.4 | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126268 | NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust | < 2026.08.0 | 6.9 | — | 2026-11-13 | |
| CVE-2026-126270 | NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint | < 2026.09.1 | 6.9 | 0.4% | 2026-11-13 | |
| CVE-2026-126269 | NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type | < 2026.09.0 | 9.3 | — | 2026-11-13 | |
| CVE-2026-126271 | NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read | < 2026.09.0 | 8.3 | 0.2% | 2026-11-13 | |
| CVE-2026-126272 | NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints | < 2026.09.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126273 | NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap | < 2026.09.0 | 9.2 | — | 2026-11-13 | |
| CVE-2026-126274 | NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog | < 2026.08.0 | 9.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126276 | NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange | < 2026.08.1 | 8.2 | — | 2026-11-13 | |
| CVE-2026-126275 | NocoDB before 2026.09.0 IDOR in Row Comment Operations | < 2026.09.0 | 7.1 | 0.3% | 2026-11-13 | |
| CVE-2026-126277 | NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API | < 2026.08.1 | 8.7 | — | 2026-11-13 | |
| CVE-2026-126278 | NocoDB before 2026.08.1 Password Reset Token Race Condition | < 2026.08.1 | 8.7 | 0.3% | 2026-11-13 | |
| CVE-2026-126279 | NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip | < 2026.06.2 | 7.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126280 | NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation | < 2026.08.0 | 9.1 | — | 2026-11-13 | |
| CVE-2026-126281 | NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy | < 2026.08.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126283 | NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens | < 2026.08.0 | 8.7 | 0.3% | 2026-11-13 | |
| CVE-2026-126282 | NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update | ≥ 2026.04.0 < 2026.08.0 | 8.6 | 0.2% | 2026-11-13 | |
| CVE-2026-126284 | NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch | ≥ 2026.05.2 < 2026.07.0 | 2.3 | — | 2026-11-13 | |
| CVE-2026-126286 | NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue | < 2026.08.0 | 8.6 | 0.4% | 2026-11-13 | |
| CVE-2026-126285 | NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter | < 2026.08.0 | 8.3 | — | 2026-11-13 | |
| CVE-2026-126287 | NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition | < 2026.06.2 | 6.0 | 0.2% | 2026-11-13 | |
| CVE-2026-126288 | NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint | < 2026.06.2 | 6.9 | — | 2026-11-13 | |
| CVE-2026-126289 | NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts | < 2026.06.1 | 5.1 | — | 2026-11-13 | |
| CVE-2026-126290 | NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read | < 2026.07.0 | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126292 | NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response | < 2026.06.1 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126291 | NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query | < 2026.06.2 | 8.7 | 0.3% | 2026-11-13 | |
| CVE-2026-126293 | NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL | < 2026.06.2 | 7.1 | — | 2026-11-13 | |
| CVE-2026-121736 | NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation | ≥ 0.300.0 < 2026.08.0 | 6.9 | — | 2026-11-04 | |
| CVE-2026-119715 | NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers | < 2026.08.0 | 5.3 | — | 2026-10-31 | |
| CVE-2026-46547 | NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL | * | 6.1 | — | 2026-06-24 | |
| CVE-2026-46548 | NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) | * | 4.3 | — | 2026-06-24 | |
| CVE-2026-46549 | NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation | * | 2.0 | — | 2026-06-24 | |
| CVE-2026-46550 | NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags | * | 5.4 | — | 2026-06-24 | |
| CVE-2026-46552 | NocoDB: Shared-base link access can invite arbitrary users as persistent base members | * | 5.8 | — | 2026-06-24 | |
| CVE-2026-46553 | NocoDB: Attachment Size Limit Bypass via Upload-by-URL | * | 2.1 | — | 2026-06-24 | |
| CVE-2026-47375 | NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` | * | 6.0 | — | 2026-06-24 | |
| CVE-2026-47376 | NocoDB: Reflected Cross-Site Scripting via Password Reset Token | * | 5.1 | — | 2026-06-24 | |
| CVE-2026-47377 | NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin | * | 5.1 | — | 2026-06-24 | |
| CVE-2026-47378 | NocoDB: Hidden Column Exposure in Public Shared View Endpoints | * | 6.9 | — | 2026-06-24 | |
| CVE-2026-47380 | NocoDB: User Enumeration via Sign-In Timing | * | 6.3 | — | 2026-06-24 | |
| CVE-2026-46551 | NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion | * | 6.5 | — | 2026-06-24 | |
| CVE-2026-46554 | NocoDB: Stale Auth Cache After API Token Deletion | * | 2.3 | — | 2026-06-24 | |
| CVE-2026-47382 | NocoDB: Server-Side Request Forgery via Database Connection Host | * | 5.3 | — | 2026-06-24 | |
| CVE-2026-47279 | NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints | * | 6.9 | — | 2026-06-24 | |
| CVE-2026-47379 | NocoDB: Plaintext Password Comparison in Shared Views | * | 6.9 | — | 2026-06-24 | |
| CVE-2026-47381 | NocoDB: Cross-Workspace Integration Use in Connection Test | * | 6.9 | — | 2026-06-24 | |
| CVE-2026-47383 | NocoDB: Stored Cross-Site Scripting via Row Comments | * | 7.4 | — | 2026-06-24 | |
| CVE-2026-47384 | NocoDB: SQL Injection via Column Title in Bulk GroupBy | * | 5.3 | — | 2026-06-24 | |
| CVE-2026-47385 | NocoDB: Path Traversal via SQLite Source Filename | * | 5.3 | — | 2026-06-24 | |
| CVE-2026-47386 | NocoDB: OAuth Authorization Code Race Condition | * | 6.3 | — | 2026-06-24 | |
| CVE-2026-47387 | NocoDB: Stored Cross-Site Scripting via Form View Redirect URL | * | 8.4 | — | 2026-06-24 | |
| CVE-2026-47388 | NocoDB: Missing Ownership Check in MCP Attachment Read | * | 2.3 | — | 2026-06-24 | |
| CVE-2026-53926 | NocoDB: OAuth Tokens Persist Through Security Events | * | 6.3 | — | 2026-06-24 | |
| CVE-2026-53927 | NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL | * | 5.1 | — | 2026-06-24 | |
| CVE-2026-53928 | NocoDB: Refresh Tokens Persist Through Password Recovery | * | 6.3 | — | 2026-06-24 | |
| CVE-2026-53929 | NocoDB: Stored Cross-Site Scripting via Secure Attachment | * | 5.1 | — | 2026-06-24 | |
| CVE-2026-53930 | NocoDB: Server-Side Request Forgery via Base Migration URL | * | 5.1 | — | 2026-06-24 | |
| CVE-2026-53931 | NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint | * | 6.9 | — | 2026-06-24 | |
| CVE-2026-28401 | NocoDB: Stored Cross-Site Scripting via Rich Text Cells | * < 0.301.3 | 5.3 | — | 2026-03-02 | |
| CVE-2026-28399 | NocoDB: SQL Injection via DATEADD Formula | * < 0.301.3 | 6.2 | — | 2026-03-02 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).