Budibase / Server
24 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-100688 | Budibase server before 3.45.0 Cross-Tenant Information Disclosure | HIGH | 7.1 | Sep 26, 2026 |
| CVE-2026-100687 | Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast | HIGH | 7.0 | Sep 26, 2026 |
| CVE-2026-100686 | Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps | HIGH | 8.6 | Sep 26, 2026 |
| CVE-2026-100685 | Budibase before 3.45.0 Information Disclosure via Chat Links | HIGH | 8.3 | Sep 26, 2026 |
| CVE-2026-100684 | Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC | CRITICAL | 9.2 | Sep 26, 2026 |
| CVE-2026-100683 | Budibase before 3.45.0 SQL Injection via column-rename DDL | HIGH | 8.9 | Sep 26, 2026 |
| CVE-2026-100682 | Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100681 | Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook | MEDIUM | 6.3 | Sep 26, 2026 |
| CVE-2026-100680 | Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import | HIGH | 8.6 | Sep 26, 2026 |
| CVE-2026-82246 | Budibase Server before 3.41.3 SSRF via Query Import | HIGH | 7.1 | Aug 28, 2026 |
| CVE-2026-82245 | Budibase before 3.41.3 Missing Authorization License Management | HIGH | 7.2 | Aug 28, 2026 |
| CVE-2026-82244 | Budibase before 3.41.3 Remote Code Execution via Plugin eval() | CRITICAL | 9.4 | Aug 28, 2026 |
| CVE-2026-82243 | Budibase Server before 3.41.3 SSRF with Credential Leakage | HIGH | 8.3 | Aug 28, 2026 |
| CVE-2026-82242 | Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization | HIGH | 8.3 | Aug 28, 2026 |
| CVE-2026-82241 | Budibase backend-core SSRF via incomplete default blacklist | HIGH | 7.1 | Aug 28, 2026 |
| CVE-2026-82240 | Budibase before 3.41.3 Privilege Escalation via User Update API | HIGH | 8.6 | Aug 28, 2026 |
| CVE-2026-82239 | Budibase before 3.41.3 Authorization Bypass via datasources/query | HIGH | 8.6 | Aug 28, 2026 |
| CVE-2026-72859 | Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL | HIGH | 8.3 | Aug 14, 2026 |
| CVE-2026-72855 | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST | HIGH | 8.4 | Aug 13, 2026 |
| CVE-2026-72851 | Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook | CRITICAL | 9.0 | Aug 13, 2026 |
| CVE-2026-72850 | Budibase before 3.40.0 Arbitrary File Write via Path Traversal | CRITICAL | 9.4 | Aug 13, 2026 |
| CVE-2026-72849 | Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF | HIGH | 8.7 | Aug 13, 2026 |
| CVE-2026-73618 | Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter | HIGH | 8.7 | Aug 13, 2026 |
| CVE-2026-73617 | Budibase before 3.40.0 NoSQL Injection via MongoDB datasource | HIGH | 7.1 | Aug 13, 2026 |
Showing 1 to 24 of 24 CVEs