CVE-2026-126274

NocoDB versions prior to 2026.08.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the Delete.vue confirmation dialog, which renders column or table titles via an unescaped innerHTML binding. Authenticated Creator users can exploit this by embedding malicious mark...