CVE-2026-72859 | High | 7.7 | 2026-08-14 | Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject… |
CVE-2026-73408 | High | 7.6 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped… |
CVE-2026-73305 | High | 8.8 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.ap… |
CVE-2026-73304 | Medium | 4.9 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by pack… |
CVE-2026-73302 | | | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email wi… |
CVE-2026-72857 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings an… |
CVE-2026-72856 | High | 8.1 | 2026-08-13 | Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On… |
CVE-2026-72855 | High | 8.5 | 2026-08-13 | Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-l… |
CVE-2026-72853 | High | 7.6 | 2026-08-13 | Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in id… |
CVE-2026-72851 | Critical | 10.0 | 2026-08-13 | Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST at… |
CVE-2026-72850 | Critical | 9.1 | 2026-08-13 | Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved d… |
CVE-2026-72849 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat ide… |
CVE-2026-73618 | High | 8.3 | 2026-08-13 | Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated… |
CVE-2026-73617 | High | 7.1 | 2026-08-13 | Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handleba… |
CVE-2026-73409 | | | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and… |
CVE-2026-73407 | | | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAu… |
CVE-2026-73406 | High | 7.5 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/inde… |
CVE-2026-73308 | Medium | 5.7 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing t… |
CVE-2026-73307 | | | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string… |
CVE-2026-73306 | Medium | 5.3 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/ap… |
CVE-2026-73303 | High | 8.2 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without bindin… |
CVE-2026-73301 | Medium | 4.3 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted… |
CVE-2026-73300 | Critical | 9.6 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enablin… |
CVE-2026-67311 | Medium | 6.8 | 2026-08-01 | Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against th… |
CVE-2026-54353 | High | 8.5 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS… |
CVE-2026-54352 | Critical | 9.6 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-upl… |
CVE-2026-54351 | High | 8.2 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request… |
CVE-2026-54350 | Critical | 10.0 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing M… |
CVE-2026-50137 | Critical | 9.4 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id (app_...) and an S3-source datas… |
CVE-2026-50136 | High | 7.4 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned… |
CVE-2026-50132 | High | 7.3 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that perf… |
CVE-2026-48153 | High | 8.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipp… |
CVE-2026-48152 | High | 8.1 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin… |
CVE-2026-48151 | High | 7.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authoriz… |
CVE-2026-48150 | Critical | 9.0 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user w… |
CVE-2026-48149 | High | 8.1 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) straight to inn… |
CVE-2026-48148 | | | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.3, the VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no vali… |
CVE-2026-48147 | Medium | 6.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.t… |
CVE-2026-48146 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fe… |
CVE-2026-48128 | | | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a queryId from automation step inputs and p… |
CVE-2026-46427 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasou… |
CVE-2026-46426 | High | 7.6 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restricti… |
CVE-2026-46425 | Critical | 9.9 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router… |
CVE-2026-46424 | Medium | 4.2 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user docu… |
CVE-2026-45719 | Medium | 6.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is… |
CVE-2026-45718 | Medium | 5.4 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint (POST /api/tables/:sourceId/actions/:actionId/trigger) fails to… |
CVE-2026-45717 | High | 8.8 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, Budibase exposes a REST API for datasource management. The route PUT /api/datasources/:datasourc… |
CVE-2026-45716 | High | 8.8 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware… |
CVE-2026-45715 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirect… |
CVE-2026-45548 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fi… |
CVE-2026-45061 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint (POST /api/plugin) validates the submitted URL with a single sub… |
CVE-2026-42239 | High | 8.1 | 2026-05-07 | Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT session token is set with httpOnly: false a… |
CVE-2026-41428 | Critical | 9.1 | 2026-04-24 | Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpo… |
CVE-2026-35218 | High | 8.7 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automat… |
CVE-2026-35216 | Critical | 9.0 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase serv… |
CVE-2026-35214 | High | 8.7 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filen… |
CVE-2026-31818 | Critical | 9.6 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource… |
CVE-2026-25044 | High | 8.8 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper s… |
CVE-2026-25043 | Medium | 5.3 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to… |
CVE-2026-33226 | High | 8.7 | 2026-03-20 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview… |
CVE-2026-31816 | Critical | 9.1 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware… |
CVE-2026-30240 | Critical | 9.6 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Pro… |
CVE-2026-25737 | High | 8.9 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists… |
CVE-2026-25045 | High | 8.8 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR… |
CVE-2026-25041 | High | 7.2 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell c… |
CVE-2026-27702 | Critical | 9.9 | 2026-02-25 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase… |
CVE-2026-25040 | High | 8.8 | 2026-01-29 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who nor… |
CVE-2023-29010 | Medium | 6.5 | 2023-04-06 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side… |
CVE-2022-3225 | High | 8.8 | 2022-09-16 | Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. |