CVE-2026-126284

NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch

NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126285

NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter

NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126286

NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue

NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126287

NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition

NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126288

NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint

NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126289

NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts

NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126290

NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read

NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126291

NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query

NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126292

NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response

NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126293

NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL

NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126294

Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-126295

NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126296

NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params

NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126297

NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances

NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126298

NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form

NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126299

NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring

NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126300

NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize

NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126301

NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize

NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126302

NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query

NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126303

NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk