budibase

Top products

The 15 most recently published vulnerabilities affecting budibase.

• CVE-2026-54356Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`7.1Aug 17, 2026
• CVE-2026-73410Budibase: SSRF via DNS rebinding in the REST datasource integration8.5Aug 17, 2026
• CVE-2026-64657Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL8.4Aug 17, 2026
• CVE-2026-72859Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL7.7Aug 14, 2026
• CVE-2026-73305Budibase: Privilege escalation via public role assignment API missing app-level authorization8.8Aug 13, 2026
• CVE-2026-73304Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users4.9Aug 13, 2026
• CVE-2026-73408Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector7.6Aug 13, 2026
• CVE-2026-72857Budibase before 3.40.0 Credential Exposure via STRING Fields7.7Aug 13, 2026
• CVE-2026-72856Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email8.1Aug 13, 2026
• CVE-2026-72855Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST8.5Aug 13, 2026
• CVE-2026-72853Budibase before 3.40.0 SQL Injection via Oracle connector7.6Aug 13, 2026
• CVE-2026-72851Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook10.0Aug 13, 2026
• CVE-2026-72850Budibase before 3.40.0 Arbitrary File Write via Path Traversal9.1Aug 13, 2026
• CVE-2026-72849Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF7.7Aug 13, 2026
• CVE-2026-73617Budibase before 3.40.0 NoSQL Injection via MongoDB datasource7.1Aug 13, 2026