The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub