High
CVE-2026-50137
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 42
Reset filters
High
CVE-2026-50136
Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
High
CVE-2026-50132
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
High
CVE-2026-48153
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
High
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
High
CVE-2026-48151
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
Critical
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
Medium
CVE-2026-48148
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
High
CVE-2026-48146
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
Medium
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
High
CVE-2026-45717
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
High
CVE-2026-45715
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
High
CVE-2026-45548
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
Critical
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
High
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
High
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
High
CVE-2026-25041
@budibase/server: Command Injection in PostgreSQL Dump Command
Critical
ghsa-4g2x-vq5p-5vj6
Budibase affected by VM2 Constructor Escape Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.