CVE-2026-126270

NocoDB versions prior to 2026.09.1 are vulnerable to an unauthenticated information disclosure due to missing authentication in the aggregated meta info route within utils.controller.ts . This flaw allows anonymous callers to access instance-wide metadata, including base enumerations, user counts...

CVE-2026-126269

NocoDB versions prior to 2026.09.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the software fails to properly neutralize input during web page generation, specifically regarding attachment MIME types . An authenticated Editor user can use the records API t...

CVE-2026-126271

NocoDB versions before 2026.09.0 are vulnerable to an information disclosure flaw where authenticated base Viewers can obtain TLS client private keys by reading a base's data source. The root cause is that the source read handler only masks the connection password, leaving the decrypted private k...

CVE-2026-126272

NocoDB versions prior to 2026.09.0 are vulnerable to an uncontrolled resource consumption (CWE-770) flaw in the v1 and v2 bulk write routes . The vulnerability allows authenticated users with Editor write permission on a table to bypass bulk row-count limits by utilizing session authentication in...

CVE-2026-126273

NocoDB versions before 2026.09.0 are vulnerable to a privilege escalation flaw in initAdminFromEnv.ts. The root cause is that the system silently skips the super-admin bootstrap process when the admin password environment variable is empty. An unauthenticated attacker can exploit this on a fresh ...

CVE-2026-126274

NocoDB versions prior to 2026.08.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the Delete.vue confirmation dialog, which renders column or table titles via an unescaped innerHTML binding. Authenticated Creator users can exploit this by embedding malicious mark...

CVE-2026-126276

NocoDB versions before 2026.08.1 are vulnerable to a client authentication bypass within the oauth-token.service.ts component. The root cause is the software's failure to properly distinguish between PKCE and confidential client authentication, causing it to skip client secret verification when t...

CVE-2026-126275

NocoDB versions before 2026.09.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within row comment operations. This flaw allows authenticated users to access row comments from unrelated bases by providing only the necessary model and row IDs . Specifically, attackers ...

CVE-2026-126277

NocoDB versions before 2026.08.1 are vulnerable to an uncontrolled resource consumption vulnerability (CWE-770) in the shared-view bulk API . An unauthenticated attacker possessing a shared view UUID can submit a large body of minimal filter objects via a POST request. This triggers a full databa...

CVE-2026-126278

NocoDB versions before 2026.08.1 are vulnerable to a race condition in users.service.ts. An attacker possessing a valid reset token can send concurrent reset requests to exploit the processing window of slow bcrypt hashing . This allows the attacker to overwrite the owner's new password before th...

CVE-2026-126279

NocoDB versions prior to 2026.06.2 are vulnerable to a stored cross-site scripting (XSS) flaw in the PromptWithFields.vue component. The root cause is the rendering of unescaped field references from AI field prompts as HTML within a tooltip. An attacker with Creator privileges or higher can inje...

CVE-2026-126280

NocoDB versions prior to 2026.08.0 are vulnerable to a race condition in the refresh-token rotation process. The flaw exists because UserRefreshToken.ts fails to verify the affected-row count during rotation. This allows an attacker with a captured refresh token to present it concurrently with a ...

CVE-2026-126281

NocoDB versions prior to 2026.08.0 are vulnerable to a missing authorization vulnerability (CWE-862) within the integrations.service.ts component. Specifically, the copy-from branch of integration creation fails to verify the owner or private flag of a source integration before decrypting its cre...

CVE-2026-126283

NocoDB versions before 2026.08.0 are vulnerable to an incorrect authorization flaw involving base-scoped API tokens . The root cause is that the system fails to store or verify the base_id associated with these tokens, allowing them to function as account-wide credentials . An attacker who obtain...

CVE-2026-126282

NocoDB versions 2026.04.0 before 2026.08.0 are susceptible to an improper privilege management vulnerability in org-users.service.ts. The root cause is that updating a user's legacy organization role incorrectly rewrites their default-workspace role . This flaw allows revoked users to silently re...

CVE-2026-126284

NocoDB versions 2026.05.2 before 2026.07.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is that the data import functionality incorrectly reused the webhook internal-network exemption. When the configurations NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK are ...

CVE-2026-126286

NocoDB versions prior to 2026.08.0 are vulnerable to a reflected cross-site scripting (XSS) flaw within the PageLeavingWarning.vue component. The root cause is the improper handling of the ncRedirectUrl scheme, where an attacker can embed an ASCII control character to bypass scheme checks. This a...

CVE-2026-126285

NocoDB versions before 2026.08.0 are vulnerable to an SQL injection flaw within the legacy where parameter on PostgreSQL . The root cause is the improper concatenation of filter values in CustomKnex.ts , allowing authenticated users with read access—including those with Viewer-role —to inject sin...

CVE-2026-126287

NocoDB versions prior to 2026.06.2 are vulnerable to a race condition in the oauth-token.service.ts component. This flaw occurs during non-atomic OAuth Refresh Token Rotation , allowing an attacker who has captured a refresh token to present it concurrently with the legitimate client. By winning ...

CVE-2026-126288

NocoDB versions before 2026.06.2 are vulnerable to an information disclosure vulnerability located in the oauth.controller.ts file. This flaw allows unauthenticated attackers to query the public client lookup route to retrieve full OAuth client records . If an attacker can guess or identify a cli...

CVE-2026-126289

NocoDB versions prior to 2026.06.1 are vulnerable to a CSV formula injection in the export.service.ts component. The root cause is the failure to neutralize record values and column titles that begin with formula characters during CSV exports. This allows low-privileged collaborators or unauthent...

CVE-2026-126290

NocoDB versions before 2026.07.0 are vulnerable to an information disclosure vulnerability in base-integrations.service.ts. Authenticated base members can bypass ownership checks by omitting a specific query flag when requesting integrations. This allows an attacker to access another user's priva...

CVE-2026-126291

NocoDB versions prior to 2026.06.2 are vulnerable to an SQL injection flaw in base-user.cte.utils.ts. The root cause is the unsafe concatenation of base members' email addresses into SQL queries used to resolve user , created-by , or last-modified-by fields. Registered users can exploit this by s...

CVE-2026-126292

NocoDB versions before 2026.06.1 are susceptible to an information disclosure vulnerability in the profile update handler located in users.service.ts . The flaw occurs because the handler returns the stored user record without applying the user-serialization filter , resulting in the exposure of ...

CVE-2026-126293

NocoDB versions prior to 2026.06.2 are vulnerable to an attachment size limit bypass via the v3 upload-by-URL endpoint. The root cause is located in data-attachment-v3.service.ts , which improperly trusts the remote server's advertised content length. This allows authenticated Editor users to upl...

CVE-2026-126295

The NLTK library versions 3.10.0 through 3.10.3 are vulnerable to an arbitrary file read vulnerability within the BllipParser component. The root cause is the processing of unvalidated model paths , which allows an attacker to force the bllipparser C extension to read sensitive files outside of t...

CVE-2026-126294

The Grav Login plugin (versions before 3.11.0 ) contains an authentication bypass vulnerability. When the global twofa_enabled setting is disabled, an attacker possessing an account password can bypass two-factor verification by using the /login form, a remember-me cookie, or a magic link. This a...

CVE-2026-126296

The NLTK library (versions before 3.10.4 ) is vulnerable to a path traversal vulnerability within the save_maxent_params() and load_maxent_params() functions. The root cause is the direct use of Python's built-in open() function, which allows an attacker who controls the tab_dir argument to bypas...

CVE-2026-126298

Versions of NLTK before 3.10.4 are vulnerable to a Denial of Service (DoS) vulnerability within the Tree.chomsky_normal_form function. The root cause is quadratic-time right-factor binarization triggered by the use of list.pop(0). A remote attacker can exploit this by providing a wide, flat treeb...

CVE-2026-126297

The NLTK library before version 3.10.4 is vulnerable to a quadratic-time denial of service (DoS) within the ConllCorpusReader._get_srl_instances function. This flaw allows remote attackers to exhaust CPU resources by providing a specially crafted CoNLL SRL corpus containing numerous predicates an...

CVE-2026-126299

The NLTK library, versions prior to 3.10.4 , is susceptible to a Quadratic-Time Denial of Service vulnerability within the CCG lexicon parser fromstring function. Remote attackers can exhaust CPU resources by providing wide inputs, specifically lexicon text containing long flat bracket bodies or ...

CVE-2026-126300

The NLTK library, versions 3.2.5 to before 3.10.4 , is vulnerable to an algorithmic complexity vulnerability in the TreebankWordTokenizer.span_tokenize function. The root cause is repeated list.pop(0) calls, which allow a remote attacker to trigger quadratic CPU consumption . By submitting long s...

CVE-2026-126301

The NLTK library, versions 3.6 through 3.10.3 , is vulnerable to a quadratic CPU exhaustion issue within the LegalitySyllableTokenizer.tokenize method. This algorithmic complexity vulnerability (CWE-407) is triggered when the software processes long, all-vowel tokens. Specifically, an unguarded o...

CVE-2026-126302

The NLTK library versions 3.9.4 before 3.10.4 is vulnerable to a symlink following flaw in the nltk.sem.chat80.sql_query() function. This vulnerability allows an attacker who has write access to a trusted NLTK data root to plant a symbolic link , effectively bypassing the pathsec data-root sandbo...

CVE-2026-126303

The NLTK library before version 3.10.4 is vulnerable to an uncontrolled resource consumption (CWE-400) flaw in the SteppingRecursiveDescentParser.parse() function. The root cause is the lack of a max_time deadline or step limit, which allows an attacker who can influence the grammar to provide an...

CVE-2026-126304

The NLTK library versions 3.10.0 before 3.10.4 are vulnerable to a symlink escape vulnerability within the YCOECorpusReader component (CWE-59). By planting psd or pos directory symlinks, an attacker who controls a YCOE corpus can bypass the corpus root to read files from other corpora or temporar...

CVE-2026-103645

The Qt framework is impacted by an integer overflow vulnerability within the QTextCodec fromUnicode() and toUnicode() functionality. This flaw affects the Qt 5 Core Compatibility APIs module (in Qt 6) and the Qt Core module (in Qt 5), specifically in builds compiled with ICU support . The vulnera...

CVE-2026-126305

EspoCRM versions prior to 9.3.11 and 10.x before 10.0.9 are vulnerable to a stored cross-site scripting (XSS) flaw within Knowledge Base articles. An attacker with permissions to create or edit Knowledge Base articles can upload a JavaScript file and include a crafted link in the article body. If...

CVE-2026-126307

Nezha Dashboard versions before 2.6.0 are vulnerable to multiple authorization , tenant isolation , and resource exhaustion flaws. These vulnerabilities allow members or unauthenticated attackers to abuse several features, including NAT , DDNS , OAuth , cron , and server transfer . Specifically, ...

CVE-2026-126306

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw allows low-privileged users to upload crafted SVG images designed to submit authenticated POST requests to arbitrary backend endpoints. An attacker can trick an admi...

CVE-2026-126308

The web dashboard in Coder versions 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 is vulnerable to a session token leak . The root cause is that the dashboard replaces the $SESSION_TOKEN placeholder in external app URLs with a f...

CVE-2026-126309

Versions of OpenBao prior to 2.6.5 and 2.7.2 are vulnerable to a path traversal vulnerability within the Transit key import functionality. This flaw allows authenticated attackers to bypass name restrictions defined in ACL policies. Specifically, attackers subject to a required_parameters name co...

CVE-2026-126311

OpenBao versions prior to 2.6.5 and 2.7.x before 2.7.2 are vulnerable to a flaw where the SSH secrets engine fails to neutralize wildcard characters in SSH certificate principals. The root cause is the rendering of unvalidated external token metadata via identity templates . An attacker who contr...

CVE-2026-126310

Versions of OpenBao prior to 2.6.5 and 2.7.2 are vulnerable to an authentication bypass in the OIDC Provider. The flaw allows unauthenticated callers to obtain OIDC ID tokens by exploiting public clients that have client_credentials enabled. Specifically, an attacker who knows a public client's c...

CVE-2026-126312

The OpenBao software versions prior to 2.6.5 and 2.7.x (before 2.7.2 ) are vulnerable to an ACL bypass via non-canonical plugin paths. This flaw exists in the AppRole, Cert, LDAP, and RADIUS authentication methods, as well as in the openbao-plugins LDAP and RADIUS auth plugins before version 0.2....

CVE-2026-126313

Frappe HRMS version 16.0.0 before 16.20.1 is vulnerable to an authorization bypass due to a missing ownership check on certain record types. This flaw allows authenticated users with only the Employee role to create or modify draft records belonging to other employees or companies they do not bel...

CVE-2026-126314

Frappe HRMS versions 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 are vulnerable to a missing authorization flaw in bulk record creation endpoints. The application fails to verify individual employee access when creating records for multiple employees simultaneously. An authenticated user with...

CVE-2026-126315

Frappe HRMS versions 16.14.0 before 16.20.1 are vulnerable to a Telemetry Setting Bypass Information Exposure flaw. The application transmits product usage events for certain HR transactions without verifying the site's telemetry settings. This allows sensitive data, including leave type names, c...

CVE-2026-126316

The software Frappe HRMS versions 16.0.0 before 16.20.1 is affected by an information exposure vulnerability (CWE-598). The application places the subscription key in the query string of outbound subscription status requests. Consequently, attackers who can access proxy, server, or monitoring log...

CVE-2026-126317

Frappe HRMS versions 16.0.0 before 16.20.1 are susceptible to a missing authorization vulnerability (CWE-862) within the Company Details endpoint . Due to a lack of proper permission checks, any authenticated user, such as those with the Employee role , can query the endpoint to retrieve a list o...