Security advisories

medium2026-06-05

CVE-2026-47385-NocoDB: Path Traversal via SQLite Source Filename

nocodb/nocodb · GHSA-wvqj-9wv4-7ff5

medium2026-06-05

CVE-2026-47384-NocoDB: SQL Injection via Column Title in Bulk GroupBy

nocodb/nocodb · GHSA-p8wx-5f39-w3x4

high2026-06-05

CVE-2026-47383-NocoDB: Stored Cross-Site Scripting via Row Comments

nocodb/nocodb · GHSA-jf3g-4gwg-4h66

medium2026-06-05

CVE-2026-47382-NocoDB: Server-Side Request Forgery via Database Connection Host

nocodb/nocodb · GHSA-w43h-r5m5-p832

medium2026-06-05

CVE-2026-47381-NocoDB: Cross-Workspace Integration Use in Connection Test

nocodb/nocodb · GHSA-96fh-m4r8-6v9v

medium2026-06-05

CVE-2026-47380-NocoDB: User Enumeration via Sign-In Timing

nocodb/nocodb · GHSA-jr54-jwhj-55gp

medium2026-06-05

CVE-2026-47379-NocoDB: Plaintext Password Comparison in Shared Views

nocodb/nocodb · GHSA-qhxg-623c-cfjm

medium2026-06-05

CVE-2026-47378-NocoDB: Hidden Column Exposure in Public Shared View Endpoints

nocodb/nocodb · GHSA-4w6r-5c2j-qf5f

medium2026-06-05

CVE-2026-47377-NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin

nocodb/nocodb · GHSA-rvp5-9p55-f5rp

medium2026-06-05

CVE-2026-47376-NocoDB: Reflected Cross-Site Scripting via Password Reset Token

nocodb/nocodb · GHSA-6xcx-7qmg-vjfq

medium2026-06-05

CVE-2026-47375-NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`

nocodb/nocodb · GHSA-cxv7-gmmp-228p

medium2026-06-05

CVE-2026-47279-NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints

nocodb/nocodb · GHSA-9wgh-m22w-9xj8

high2026-06-05

CVE-2026-47261-wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

bytecodealliance/wasmtime · GHSA-2r75-cxrj-cmph

medium2026-06-05

CVE-2026-47250-MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration

flux159/mcp-server-kubernetes · GHSA-6mx4-4h42-r8vh

medium2026-06-05

CVE-2026-37737-sanic-cors contains an improper regular expression in the try_match() function

ashleysommer/sanic-cors · GHSA-94jw-hqvj-vw74

low2026-06-05

CVE-2026-11330-claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision

thedotmack/claude-mem · GHSA-5gvr-v6qv-h5mm

high2026-06-05

CVE-2026-47249-Klever-Go KVM: Hash-array amplification in P2P resolver request handling

klever-io/klever-go · GHSA-w342-mj6g-v9c4

high2026-06-05

CVE-2026-45726-Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

siderolabs/omni · GHSA-wv8c-6mx2-xf4j

low2026-06-05

CVE-2026-45723-Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

siderolabs/omni · GHSA-c66c-vq6w-fvh5

high2026-06-05

CVE-2026-45720-Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token

siderolabs/omni · GHSA-5x9f-6vg5-qg4m