Product by Budibase

    Server

    24 known vulnerabilities in Server (Budibase), 0 of them actively exploited (CISA KEV).

    Key figures

    24

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Server (Budibase)
    CriticalCVE-2026-82244

    Budibase before 3.41.3 Remote Code Execution via Plugin eval()

    		9.1
    HighCVE-2026-100682

    Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

    also in 1 other product

    		8.8
    CriticalCVE-2026-100684

    Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

    also in 1 other product

    		8.1
    CriticalCVE-2026-72850

    Budibase before 3.40.0 Arbitrary File Write via Path Traversal

    		9.1
    CriticalCVE-2026-72851

    Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

    		10.0
    HighCVE-2026-100683

    Budibase before 3.45.0 SQL Injection via column-rename DDL

    also in 1 other product

    		8.0
    HighCVE-2026-100680

    Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import

    also in 1 other product

    		8.1
    HighCVE-2026-100686

    Budibase Server: Improper Privilege Management

    also in 1 other product

    		8.1
    HighCVE-2026-82240

    Budibase before 3.41.3 Privilege Escalation via User Update API

    		8.1
    HighCVE-2026-82245

    Budibase before 3.41.3 Missing Authorization License Management

    		8.1
    HighCVE-2026-82239

    Budibase before 3.41.3 Authorization Bypass via datasources/query

    		8.1
    HighCVE-2026-73618

    Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

    		8.3
    HighCVE-2026-72855

    Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

    		8.5
    HighCVE-2026-100685

    Budibase before 3.45.0 Information Disclosure via Chat Links

    also in 1 other product

    		7.7
    HighCVE-2026-82242

    Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization

    		7.7
    HighCVE-2026-100688

    Budibase server before 3.45.0 Cross-Tenant Information Disclosure

    also in 1 other product

    		6.5
    HighCVE-2026-82243

    Budibase Server before 3.41.3 SSRF with Credential Leakage

    		7.6
    HighCVE-2026-72849

    Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

    		7.7
    HighCVE-2026-100687

    Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

    also in 1 other product

    		5.5
    HighCVE-2026-72859

    Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

    also in 1 other product

    		7.7
    MediumCVE-2026-100681

    Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

    also in 1 other product

    		5.4
    HighCVE-2026-73617

    Budibase before 3.40.0 NoSQL Injection via MongoDB datasource

    		7.1
    HighCVE-2026-82241

    Budibase backend-core SSRF via incomplete default blacklist

    		7.1
    HighCVE-2026-82246

    Budibase Server before 3.41.3 SSRF via Query Import

    		7.1

    News

    All products by Budibase