Budibase server

• CVE-2026-100688 Medium 6.5 Budibase server before 3.45.0 Cross-Tenant Information Disclosure 0.3%
• CVE-2026-100687 Medium 5.5 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast 0.3%
• CVE-2026-100686 High 8.1 Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps 0.3%
• CVE-2026-100685 High 7.7 Budibase before 3.45.0 Information Disclosure via Chat Links 0.3%
• CVE-2026-100684 High 8.1 Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC 0.4%
• CVE-2026-100683 High 8.0 Budibase before 3.45.0 SQL Injection via column-rename DDL 0.3%
• CVE-2026-100682 High 8.8 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink 0.7%
• CVE-2026-100681 Medium 5.4 Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook 0.3%
• CVE-2026-100680 High 8.1 Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import 0.3%
• CVE-2026-82246 High 7.1 Budibase Server before 3.41.3 SSRF via Query Import 0.2%
• CVE-2026-82245 High 8.1 Budibase before 3.41.3 Missing Authorization License Management 0.4%
• CVE-2026-82244 Critical 9.1 Budibase before 3.41.3 Remote Code Execution via Plugin eval() 0.9%
• CVE-2026-82243 High 7.6 Budibase Server before 3.41.3 SSRF with Credential Leakage 0.3%
• CVE-2026-82242 High 7.7 Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization 0.4%
• CVE-2026-82241 High 7.1 Budibase backend-core SSRF via incomplete default blacklist 0.3%
• CVE-2026-82240 High 8.1 Budibase before 3.41.3 Privilege Escalation via User Update API 0.4%
• CVE-2026-82239 High 8.1 Budibase before 3.41.3 Authorization Bypass via datasources/query 0.3%
• CVE-2026-72859 High 7.7 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL 0.2%
• CVE-2026-72855 High 8.5 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST 0.4%
• CVE-2026-72851 Critical 10.0 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook 0.4%
• CVE-2026-72850 Critical 9.1 Budibase before 3.40.0 Arbitrary File Write via Path Traversal 0.5%
• CVE-2026-72849 High 7.7 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF 0.2%
• CVE-2026-73618 High 8.3 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter 0.4%
• CVE-2026-73617 High 7.1 Budibase before 3.40.0 NoSQL Injection via MongoDB datasource 0.3%