Affected version lines
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-103757 | Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation | < 3.41.0 | 8.3 | — | 2026-10-01 | |
| CVE-2026-100688 | Budibase server before 3.45.0 Cross-Tenant Information Disclosure | * | 7.1 | — | 2026-09-26 | |
| CVE-2026-100687 | Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast | * | 7.0 | — | 2026-09-26 | |
| CVE-2026-100686 | Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps | * | 8.6 | — | 2026-09-26 | |
| CVE-2026-100685 | Budibase before 3.45.0 Information Disclosure via Chat Links | * | 8.3 | — | 2026-09-26 | |
| CVE-2026-100684 | Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC | * | 9.2 | — | 2026-09-26 | |
| CVE-2026-100683 | Budibase before 3.45.0 SQL Injection via column-rename DDL | * | 8.9 | — | 2026-09-26 | |
| CVE-2026-100682 | Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink | * | 8.7 | — | 2026-09-26 | |
| CVE-2026-100681 | Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook | * | 6.3 | — | 2026-09-26 | |
| CVE-2026-100680 | Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import | * | 8.6 | — | 2026-09-26 | |
| CVE-2026-82246 | Budibase Server before 3.41.3 SSRF via Query Import | * | 7.1 | — | 2026-08-28 | |
| CVE-2026-82245 | Budibase before 3.41.3 Missing Authorization License Management | * | 7.2 | — | 2026-08-28 | |
| CVE-2026-82244 | Budibase before 3.41.3 Remote Code Execution via Plugin eval() | * | 9.4 | — | 2026-08-28 | |
| CVE-2026-82243 | Budibase Server before 3.41.3 SSRF with Credential Leakage | * | 8.3 | — | 2026-08-28 | |
| CVE-2026-82242 | Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization | * | 8.3 | — | 2026-08-28 | |
| CVE-2026-82241 | Budibase backend-core SSRF via incomplete default blacklist | * | 7.1 | — | 2026-08-28 | |
| CVE-2026-82240 | Budibase before 3.41.3 Privilege Escalation via User Update API | * | 8.6 | — | 2026-08-28 | |
| CVE-2026-82239 | Budibase before 3.41.3 Authorization Bypass via datasources/query | * | 8.6 | — | 2026-08-28 | |
| CVE-2026-54356 | Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` | * | 7.1 | — | 2026-08-18 | |
| CVE-2026-35219 | Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist | * | 7.1 | — | 2026-08-18 | |
| CVE-2026-73410 | Budibase: SSRF via DNS rebinding in the REST datasource integration | * | 8.5 | — | 2026-08-18 | |
| CVE-2026-64657 | Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL | * | 8.4 | — | 2026-08-18 | |
| CVE-2026-72859 | Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL | * | 8.3 | — | 2026-08-14 | |
| CVE-2026-73305 | Budibase: Privilege escalation via public role assignment API missing app-level authorization | * | 8.8 | — | 2026-08-14 | |
| CVE-2026-73304 | Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users | * | 4.9 | — | 2026-08-14 | |
| CVE-2026-73408 | Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector | * | 7.6 | — | 2026-08-14 | |
| CVE-2026-73302 | Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified | * | 9.0 | — | 2026-08-14 | |
| CVE-2026-72856 | Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email | < 3.40.0 | 8.6 | — | 2026-08-14 | |
| CVE-2026-72857 | Budibase before 3.40.0 Credential Exposure via STRING Fields | < 3.40.0 | 8.3 | — | 2026-08-14 | |
| CVE-2026-72855 | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST | * | 8.4 | — | 2026-08-14 | |
| CVE-2026-72853 | Budibase before 3.40.0 SQL Injection via Oracle connector | < 3.40.0 | 8.8 | — | 2026-08-14 | |
| CVE-2026-72851 | Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook | * | 9.0 | — | 2026-08-14 | |
| CVE-2026-72850 | Budibase before 3.40.0 Arbitrary File Write via Path Traversal | * | 9.4 | — | 2026-08-14 | |
| CVE-2026-72849 | Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF | * | 8.7 | — | 2026-08-14 | |
| CVE-2026-73618 | Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter | * | 8.7 | — | 2026-08-13 | |
| CVE-2026-73617 | Budibase before 3.40.0 NoSQL Injection via MongoDB datasource | * | 7.1 | — | 2026-08-13 | |
| CVE-2026-73409 | Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile | * | 5.1 | — | 2026-08-13 | |
| CVE-2026-73407 | Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-4815... | * | 9.0 | — | 2026-08-13 | |
| CVE-2026-73406 | Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint | * | 7.5 | — | 2026-08-13 | |
| CVE-2026-73308 | Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders | * | 5.7 | — | 2026-08-13 | |
| CVE-2026-73307 | Budibase: SSRF via bare fetch() in uploadUrl during AI table generation | * | 4.9 | — | 2026-08-13 | |
| CVE-2026-73306 | Budibase: Account Enumeration via Login Lockout Response Differential | * | 5.3 | — | 2026-08-13 | |
| CVE-2026-73303 | Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated again... | * | 8.2 | — | 2026-08-13 | |
| CVE-2026-73301 | Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role ma... | * | 4.3 | — | 2026-08-13 | |
| CVE-2026-73300 | Budibase: SQL Injection via `multipleStatements: true` | * | 9.6 | — | 2026-08-13 | |
| CVE-2026-67311 | Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect | < 3.38.1 | 8.2 | — | 2026-08-01 | |
| CVE-2026-54351 | Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override | * | 8.2 | — | 2026-06-27 | |
| CVE-2026-54353 | Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation | * | 8.5 | — | 2026-06-27 | |
| CVE-2026-54350 | Budibase: Anonymous NoSQL operator injection via published-app query templates | * | 10.0 | — | 2026-06-27 | |
| CVE-2026-50137 | Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pr... | * | 8.2 | — | 2026-06-27 | |
| CVE-2026-50136 | Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource crede... | * | 7.4 | — | 2026-06-27 | |
| CVE-2026-50132 | Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase | * | 7.3 | — | 2026-06-27 | |
| CVE-2026-54352 | Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload | * | 9.6 | — | 2026-06-27 | |
| CVE-2026-48147 | Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker | * | 6.5 | — | 2026-05-28 | |
| CVE-2026-48148 | Budibase: Unvalidated VectorDB Host Parameter Enables SSRF | * | 5.3 | — | 2026-05-28 | |
| CVE-2026-45548 | Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation | * | 7.7 | — | 2026-05-28 | |
| CVE-2026-45715 | Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration | * | 7.7 | — | 2026-05-28 | |
| CVE-2026-45716 | Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration | * | 8.8 | — | 2026-05-28 | |
| CVE-2026-45717 | Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder... | * | 8.8 | — | 2026-05-28 | |
| CVE-2026-45718 | Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows | * | 5.4 | — | 2026-05-28 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).