Budibase

Products

Exploited and recent CVEs

• CVE-2026-103757 High 7.7 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation 0.3%
• CVE-2026-100688 Medium 6.5 Budibase server before 3.45.0 Cross-Tenant Information Disclosure 0.3%
• CVE-2026-100687 Medium 5.5 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast 0.3%
• CVE-2026-100686 High 8.1 Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps 0.3%
• CVE-2026-100685 High 7.7 Budibase before 3.45.0 Information Disclosure via Chat Links 0.3%
• CVE-2026-100684 High 8.1 Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC 0.4%
• CVE-2026-100683 High 8.0 Budibase before 3.45.0 SQL Injection via column-rename DDL 0.3%
• CVE-2026-100682 High 8.8 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink 0.7%
• CVE-2026-100681 Medium 5.4 Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook 0.3%
• CVE-2026-100680 High 8.1 Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import 0.3%
• CVE-2026-82246 High 7.1 Budibase Server before 3.41.3 SSRF via Query Import 0.2%
• CVE-2026-82245 High 8.1 Budibase before 3.41.3 Missing Authorization License Management 0.4%
• CVE-2026-82244 Critical 9.1 Budibase before 3.41.3 Remote Code Execution via Plugin eval() 0.9%
• CVE-2026-82243 High 7.6 Budibase Server before 3.41.3 SSRF with Credential Leakage 0.3%
• CVE-2026-82242 High 7.7 Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization 0.4%
• CVE-2026-82241 High 7.1 Budibase backend-core SSRF via incomplete default blacklist 0.3%
• CVE-2026-82240 High 8.1 Budibase before 3.41.3 Privilege Escalation via User Update API 0.4%
• CVE-2026-82239 High 8.1 Budibase before 3.41.3 Authorization Bypass via datasources/query 0.3%
• CVE-2026-54356 High 7.1 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` 0.4%
• CVE-2026-35219 High 7.1 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist 0.5%
• CVE-2026-73410 High 8.5 Budibase: SSRF via DNS rebinding in the REST datasource integration 0.3%
• CVE-2026-64657 High 8.4 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL 0.4%
• CVE-2026-72859 High 7.7 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL 0.2%
• CVE-2026-73305 High 8.8 Budibase: Privilege escalation via public role assignment API missing app-level authorization 0.5%
• CVE-2026-73304 Medium 4.9 Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users 0.5%
• CVE-2026-73408 High 7.6 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector 0.5%
• CVE-2026-73302 Critical 9.0 Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified 0.4%
• CVE-2026-72857 High 7.7 Budibase before 3.40.0 Credential Exposure via STRING Fields 0.4%
• CVE-2026-72856 High 8.1 Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email 0.5%
• CVE-2026-72855 High 8.5 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST 0.4%