https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-15T11:58:26.401306+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-126291 CVE-2026-126291 — NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query 2026-11-15T11:58:26.403670+00:00

Affected: nocodb

NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials.