Database

In NocoDB versions prior to 0.301.0 a medium severity vulnerability CVE-2026-24766 was detected. This vulnerability allows authenticated users with org-level-creator permissions to exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until the server is restarted, resulting in a denial of service. To address this issue, users should upgrade NocoDB to version 0.301.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24766.

In NocoDB versions prior to 0.301.0 a high severity vulnerability CVE-2026-24769 was detected. This vulnerability allows authenticated attackers to upload malicious SVG files containing embedded JavaScript, which are later executed in the browsers of users who view the attachment, potentially leading to account compromise, data exfiltration, and unauthorized actions. To address this issue, users should upgrade NocoDB to version 0.301.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24769.

In NocoDB versions prior to 0.301.0 a medium severity vulnerability CVE-2026-24768 was detected. This vulnerability allows attackers to perform unvalidated redirects via the `continueAfterSignIn` parameter in the login flow, potentially redirecting users to arbitrary external websites and enabling phishing attacks. To address this issue, users should upgrade NocoDB to version 0.301.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24768.

In NocoDB versions prior to 0.301.0 a medium severity vulnerability CVE-2026-24767 was detected. This vulnerability allows attackers to perform blind Server-Side Request Forgery (SSRF) via unvalidated `HEAD` requests in the `uploadViaURL` functionality, enabling limited outbound requests to arbitrary URLs before SSRF protections are enforced. To address this issue, users should upgrade NocoDB to version 0.301.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24767.

In Oracle MySQL Server Optimizer component versions 8.0.0 through 8.0.44, 8.4.0 through 8.4.7 and 9.0.0 through 9.5.0 a medium severity vulnerability CVE-2026-21968 was detected. This vulnerability allows a low-privileged attacker with network access to cause a hang or repeatedly crash the MySQL Server, resulting in a complete denial of service. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-21968.

In Oracle MySQL Server Thread Pooling component versions 8.0.0 through 8.0.44, 8.4.0 through 8.4.7 and 9.0.0 through 9.5.0 a medium severity vulnerability CVE-2026-21964 was detected. This vulnerability allows a high-privileged attacker with network access to cause a complete denial of service by triggering a hang or repeated crashes of the MySQL Server. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-21964.

In Oracle MySQL Server versions 9.0.0 through 9.5.0 a medium severity vulnerability CVE-2026-21952 was detected. This vulnerability allows a high-privileged attacker with network access to cause a hang or a repeatedly reproducible crash, resulting in a complete denial of service (DoS) of the MySQL Server due to an issue in the Server Parser component. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-21952.

In MongoDB Server versions prior to 7.0.28, 8.0.17, 8.2.3, 6.0.27, 5.0.32, 4.4.30, and versions greater than or equal to 4.2.0, 4.0.0, and 3.6.0 a high severity vulnerability CVE-2025-14847 was detected. This vulnerability may allow an unauthenticated client to read uninitialized heap memory due to mismatched length fields in Zlib compressed protocol headers. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14847.

In MariaDB versions affected by CVE-2025-13699 a medium severity vulnerability was detected. This vulnerability allows remote attackers to execute arbitrary code via the mariadb-dump utility due to improper validation of user-supplied paths in view names, enabling directory traversal and code execution in the context of the current user. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13699.