Budibase vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 202689

Newest CVEs

• CVE-2026-103757

  Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

  Budibase · budibase

  High8.3
• CVE-2026-100688

  Budibase server before 3.45.0 Cross-Tenant Information Disclosure

  budibase · server

  High7.1
• CVE-2026-100687

  Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

  budibase · server

  High7.0
• CVE-2026-100686

  Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps

  budibase · server

  High8.6
• CVE-2026-100685

  Budibase before 3.45.0 Information Disclosure via Chat Links

  budibase · server

  High8.3
• CVE-2026-100684

  Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

  budibase · server

  Critical9.2
• CVE-2026-100683

  Budibase before 3.45.0 SQL Injection via column-rename DDL

  budibase · server

  High8.9
• CVE-2026-100682

  Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

  budibase · server

  High8.7
• CVE-2026-100681

  Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

  budibase · server

  Medium6.3
• CVE-2026-100680

  Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import

  budibase · server

  High8.6