Vendor

    Budibase

    91 known vulnerabilities in products by Budibase, 0 of them actively exploited (CISA KEV).

    Key figures

    91

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    20

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Budibase
    CriticalCVE-2026-31816

    Budibase Universal Auth Bypass via Webhook Query Param Injection

    		9.1
    CriticalCVE-2026-35216

    Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

    		9.1
    CriticalCVE-2026-82244

    Budibase before 3.41.3 Remote Code Execution via Plugin eval()

    		9.1
    HighCVE-2026-100682

    Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

    also in 1 other product

    		8.8
    CriticalCVE-2026-73300

    Budibase: SQL Injection via `multipleStatements: true`

    also in 1 other product

    		9.6
    CriticalCVE-2026-54350

    Budibase: Anonymous NoSQL operator injection via published-app query templates

    also in 1 other product

    		10.0
    CriticalCVE-2026-100684

    Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

    also in 1 other product

    		8.1
    CriticalCVE-2026-72850

    Budibase before 3.40.0 Arbitrary File Write via Path Traversal

    		9.1
    CriticalCVE-2026-73407

    Budibase: Path Traversal

    also in 1 other product

    		—
    HighCVE-2026-73305

    Budibase: Privilege escalation via public role assignment API missing app-level authorization

    		8.8
    CriticalCVE-2026-54352

    Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

    		9.6
    CriticalCVE-2026-72851

    Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

    		10.0
    HighCVE-2026-72856

    Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email

    		8.1
    CriticalCVE-2026-73302

    Budibase: Improper Authentication

    		—
    HighCVE-2026-64657

    Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

    also in 1 other product

    		8.4
    CriticalCVE-2026-50137

    Budibase: Missing Authorization

    		9.4
    HighCVE-2026-100683

    Budibase before 3.45.0 SQL Injection via column-rename DDL

    also in 1 other product

    		8.0
    HighCVE-2026-35214

    Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

    		8.7
    HighCVE-2026-100680

    Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import

    also in 1 other product

    		8.1
    HighCVE-2022-3225

    Improper Control of Dynamically-Managed Code Resources in budibase/budibase

    		8.8
    HighCVE-2026-73406

    Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

    also in 1 other product

    		7.5
    HighCVE-2026-25040

    Budibase: Incorrect Authorization

    		8.8
    HighCVE-2026-100686

    Budibase Server: Improper Privilege Management

    also in 1 other product

    		8.1
    HighCVE-2026-82240

    Budibase before 3.41.3 Privilege Escalation via User Update API

    		8.1
    HighCVE-2026-82245

    Budibase before 3.41.3 Missing Authorization License Management

    		8.1

    All vulnerabilities in search

    News

    Products

    Products by Budibase
    Budibase670
    Server240