CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,468
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product budibase:budibase. Show all products

45 CVEs, showing 1 to 45
CVESeverityTitlePublished
CVE-2026-25040High 8.8Budibase is a low code platform for creating internal tools, workflows, and admin panels.Jan 29, 2026
CVE-2026-27702Critical 9.0Budibase is a low code platform for creating internal tools, workflows, and admin panels.Feb 25, 2026
CVE-2026-25041High 7.2Budibase is a low code platform for creating internal tools, workflows, and admin panels.Mar 9, 2026
CVE-2026-25045High 8.8Budibase is a low code platform for creating internal tools, workflows, and admin panels.Mar 9, 2026
CVE-2026-25737Critical 9.0Budibase is a low code platform for creating internal tools, workflows, and admin panels.Mar 9, 2026
CVE-2026-30240High 8.1Budibase is a low code platform for creating internal tools, workflows, and admin panels.Mar 9, 2026
CVE-2026-31816Critical 9.1Budibase is a low code platform for creating internal tools, workflows, and admin panels.Mar 9, 2026
CVE-2026-33226High 8.7Budibase is a low code platform for creating internal tools, workflows, and admin panels.Mar 20, 2026
CVE-2026-25043High 7.5Budibase is an open-source low-code platform.Apr 3, 2026
CVE-2026-25044High 8.8Budibase is an open-source low-code platform.Apr 3, 2026
CVE-2026-31818Critical 9.9Budibase is an open-source low-code platform.Apr 3, 2026
CVE-2026-35214High 8.7Budibase is an open-source low-code platform.Apr 3, 2026
CVE-2026-35216Critical 9.0Budibase is an open-source low-code platform.Apr 3, 2026
CVE-2026-35218High 8.7Budibase is an open-source low-code platform.Apr 3, 2026
CVE-2026-41428Critical 9.1Budibase is an open-source low-code platform.Apr 24, 2026
CVE-2026-42239High 8.1Budibase is an open-source low-code platform.May 7, 2026
CVE-2026-50132High 7.3Budibase is an open-source low-code platform.Jun 26, 2026
CVE-2026-50136Medium 5.3Budibase is an open-source low-code platform.Jun 26, 2026
CVE-2026-50137Critical 9.4Budibase is an open-source low-code platform.Jun 26, 2026
CVE-2026-54350Critical 9.8Budibase is an open-source low-code platform.Jun 26, 2026
CVE-2026-54351Critical 9.6Budibase is an open-source low-code platform.Jun 26, 2026
CVE-2026-54352Critical 9.6Budibase is an open-source low-code platform.Jun 26, 2026
CVE-2026-54353High 7.1Budibase is an open-source low-code platform.Jun 26, 2026
CVE-2026-67311Medium 6.8Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
Assigned by VulnCheck
Aug 1, 2026
CVE-2026-73300Critical 9.6Budibase: SQL Injection via `multipleStatements: true`
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73301Medium 4.3Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73303High 8.2Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73306Medium 5.3Budibase: Account Enumeration via Login Lockout Response Differential
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73307Medium 4.9Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73308Medium 5.7Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73406High 7.5Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73407Critical 9.0Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73409Medium 5.1Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-72853High 7.6Budibase before 3.40.0 SQL Injection via Oracle connector
Assigned by VulnCheck
Aug 13, 2026
CVE-2026-72856High 8.1Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email
Assigned by VulnCheck
Aug 13, 2026
CVE-2026-72857High 7.7Budibase before 3.40.0 Credential Exposure via STRING Fields
Assigned by VulnCheck
Aug 13, 2026
CVE-2026-73302Critical 9.0Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
Assigned by GitHub_M
Aug 13, 2026
CVE-2026-73408High 7.6Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Assigned by GitHub_M
Aug 13, 2026
CVE-2026-73304Medium 4.9Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
Assigned by GitHub_M
Aug 13, 2026
CVE-2026-73305High 8.8Budibase: Privilege escalation via public role assignment API missing app-level authorization
Assigned by GitHub_M
Aug 13, 2026
CVE-2026-64657High 8.4Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Assigned by GitHub_M
Aug 17, 2026
CVE-2026-73410High 8.5Budibase: SSRF via DNS rebinding in the REST datasource integration
Assigned by GitHub_M
Aug 17, 2026
CVE-2026-35219High 7.1Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Assigned by GitHub_M
Aug 17, 2026
CVE-2026-54356High 7.1Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
Assigned by GitHub_M
Aug 17, 2026
CVE-2026-103757High 7.7Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation
Assigned by VulnCheck
Oct 1, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.