https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 00:37:55 +0000 https://cve.radiocsirt.org/vuln/cve-2026-47384 <p><strong>Affected:</strong> nocodb</p> <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column&#39;s title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific knex.raw() aggregations that interpolate the request&#39;s column_name directly into the SQL string. Column lookup in data-table.service.ts matches on both the sanitized column_name field and the free-text title, so a title containing a SQL fragment bypasses the public endpoint&#39;s existing column allowlist and reaches the query builder unescaped. This vulnerability is fixed in 2026.05.1.</p> <p><strong>Affected:</strong> nocodb</p> <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column&#39;s title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific knex.raw() aggregations that interpolate the request&#39;s column_name directly into the SQL string. Column lookup in data-table.service.ts matches on both the sanitized column_name field and the free-text title, so a title containing a SQL fragment bypasses the public endpoint&#39;s existing column allowlist and reaches the query builder unescaped. This vulnerability is fixed in 2026.05.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-47384