Vulnerabilidades em nocodb

58 resultados
Análise Vexday

O NocoDB acumula 58 CVEs catalogadas, com crescimento relevante no período recente — 29 vulnerabilidades surgiram nos últimos 90 dias, o que indica aceleração no ritmo de descoberta e merece atenção contínua. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, sem registros confirmados de exploração em ambiente real no momento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e a CVE de maior risco presente no radar é CVE-2022-3423, com score EPSS de 0,0179, sugerindo probabilidade ainda baixa de exploração imediata, mas que deve ser considerada dado o contexto de 5 vulnerabilidades críticas catalogadas. A existência de pelo menos uma PoC pública reforça a necessidade de manter ciclos de patching ágeis, especialmente em implantações expostas à internet.

CVE-2026-47381MEDIUMNocoDB: Cross-Workspace Integration Use in Connection TestEPSS 0.3%CVE-2026-46552MEDIUMNocoDB: Shared-base link access can invite arbitrary users as persistent base membersEPSS 0.3%CVE-2026-47384MEDIUMNocoDB: SQL Injection via Column Title in Bulk GroupByEPSS 0.3%CVE-2026-53931MEDIUMNocoDB: Server-Side Request Forgery via Spreadsheet Import EndpointEPSS 0.3%CVE-2026-53926MEDIUMNocoDB: OAuth Tokens Persist Through Security EventsEPSS 0.3%CVE-2026-53930MEDIUMNocoDB: Server-Side Request Forgery via Base Migration URLEPSS 0.3%CVE-2026-53929MEDIUMNocoDB: Stored Cross-Site Scripting via Secure AttachmentEPSS 0.3%CVE-2026-47383HIGHNocoDB: Stored Cross-Site Scripting via Row CommentsEPSS 0.3%CVE-2026-53927MEDIUMNocoDB: Server-Side Request Forgery via Spreadsheet Fetch URLEPSS 0.3%CVE-2026-24768MEDIUMNocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn ParameterEPSS 0.3%CVE-2026-47376MEDIUMNocoDB: Reflected Cross-Site Scripting via Password Reset TokenEPSS 0.3%CVE-2026-47379MEDIUMNocoDB: Plaintext Password Comparison in Shared ViewsEPSS 0.3%CVE-2026-53928MEDIUMNocoDB: Refresh Tokens Persist Through Password RecoveryEPSS 0.2%CVE-2026-46553LOWNocoDB: Attachment Size Limit Bypass via Upload-by-URLEPSS 0.2%CVE-2026-47279MEDIUMNocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation EndpointsEPSS 0.2%CVE-2026-47378MEDIUMNocoDB: Hidden Column Exposure in Public Shared View EndpointsEPSS 0.2%CVE-2026-47377MEDIUMNocoDB: Open Redirect via Hash Fragment in hashRedirect PluginEPSS 0.2%CVE-2026-46551MEDIUMNocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk ExhaustionEPSS 0.2%CVE-2026-47387HIGHNocoDB: Stored Cross-Site Scripting via Form View Redirect URLEPSS 0.2%CVE-2026-47375MEDIUMNocoDB: Postgres SQL Injection in Formula `ARRAYSORT`EPSS 0.2%