CVE-2026-126285

Published 13 November 2026 · tracked since 13 November 2026

Description

NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-126293 MEDIUM 6.5
• CVE-2026-126268 MEDIUM 5.3
• CVE-2026-126029 MEDIUM 6.4
• CVE-2026-125948 MEDIUM 6.4
• CVE-2026-125409 MEDIUM 6.4
• CVE-2026-125055 CRITICAL 9.8
• CVE-2026-124218 HIGH 8.2
• CVE-2026-123769 HIGH 8.8
• CVE-2026-122227 MEDIUM 6.5
• CVE-2026-122063 MEDIUM 6.5

→ Open the live CVE board · all tools