[ Vendor · 10 CVEs ]
budibase
CVEs affecting budibase published in the last 30 days, plus any budibase CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103757 | 1 Oct 2026 | CVSS 7.7 | budibaseBudibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in… | |
| CVE-2026-100686 | 26 Sep 2026 | CVSS 8.1 | budibase serverBudibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to… | |
| CVE-2026-100687 | 26 Sep 2026 | CVSS 5.5 | budibase serverBudibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder… | |
| CVE-2026-100688 | 26 Sep 2026 | CVSS 6.5 | budibase serverBudibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint… | |
| CVE-2026-100680 | 26 Sep 2026 | CVSS 8.1 | budibase serverBudibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated… | |
| CVE-2026-100681 | 26 Sep 2026 | CVSS 5.4 | budibase serverBudibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams… | |
| CVE-2026-100682 | 26 Sep 2026 | CVSS 8.8 | budibase serverBudibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives… | |
| CVE-2026-100683 | 26 Sep 2026 | CVSS 8.0 | budibase serverBudibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating… | |
| CVE-2026-100684 | 26 Sep 2026 | CVSS 8.1 | budibase serverBudibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no… | |
| CVE-2026-100685 | 26 Sep 2026 | CVSS 7.7 | budibase serverBudibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link… |