Budibase budibase

• CVE-2026-41428 Critical 9.1 Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints 0.4%
• CVE-2026-35218 High 8.7 Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette 0.3%
• CVE-2026-35216 Critical 9.1 Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step 10.9%
• CVE-2026-35214 High 8.7 Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write 0.6%
• CVE-2026-31818 Critical 9.6 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist 0.4%
• CVE-2026-25044 High 8.7 Budibase: Command Injection in Bash Automation Step 0.5%
• CVE-2026-25043 Medium 5.3 Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding 0.3%
• CVE-2026-33226 High 8.7 Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview 0.4%
• CVE-2026-31816 Critical 9.1 Budibase Universal Auth Bypass via Webhook Query Param Injection 16.7%
• CVE-2026-30240 Critical 9.6 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets 0.3%
• CVE-2026-25045 High 8.7 Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role) 0.3%
• CVE-2026-25737 High 8.9 Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS) 0.3%
• CVE-2026-25041 High 8.6 Budibase has a Command Injection in PostgreSQL Dump Command 0.5%
• CVE-2026-27702 Critical 9.9 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) 0.4%
• CVE-2026-25040 Medium 5.7 Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role 0.6%
• CVE-2023-29010 Medium 6.5 BudiBase Server-Side Request Forgery vulnerability 0.6%