CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 12:23 UTC)

What this means for you

This week: 5,496 CVEs published, 359 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,496; Show in the list
Critical, last 7 days: 359; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product budibase:server. Show all products

24 CVEs, showing 1 to 24

CVE	Severity	Title	Published
CVE-2026-73617	High 7.1	Budibase before 3.40.0 NoSQL Injection via MongoDB datasource Assigned by VulnCheck	Aug 13, 2026
CVE-2026-73618	High 8.3	Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter Assigned by VulnCheck	Aug 13, 2026
CVE-2026-72849	High 7.7	Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF Assigned by VulnCheck	Aug 13, 2026
CVE-2026-72850	Critical 9.1	Budibase before 3.40.0 Arbitrary File Write via Path Traversal Assigned by VulnCheck	Aug 13, 2026
CVE-2026-72851	Critical 10.0	Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook Assigned by VulnCheck	Aug 13, 2026
CVE-2026-72855	High 8.5	Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST Assigned by VulnCheck	Aug 13, 2026
CVE-2026-72859	High 7.7	Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL Assigned by VulnCheck	Aug 14, 2026
CVE-2026-82239	High 8.1	Budibase before 3.41.3 Authorization Bypass via datasources/query Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82240	High 8.1	Budibase before 3.41.3 Privilege Escalation via User Update API Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82241	High 7.1	Budibase backend-core SSRF via incomplete default blacklist Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82242	High 7.7	Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82243	High 7.6	Budibase Server before 3.41.3 SSRF with Credential Leakage Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82244	Critical 9.1	Budibase before 3.41.3 Remote Code Execution via Plugin eval() Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82245	High 8.1	Budibase before 3.41.3 Missing Authorization License Management Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82246	High 7.1	Budibase Server before 3.41.3 SSRF via Query Import Assigned by VulnCheck	Aug 28, 2026
CVE-2026-100680	High 8.1	Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100681	Medium 5.4	Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100682	High 8.8	Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100683	High 8.0	Budibase before 3.45.0 SQL Injection via column-rename DDL Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100684	High 8.1	Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100685	High 7.7	Budibase before 3.45.0 Information Disclosure via Chat Links Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100686	High 8.1	Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100687	Medium 5.5	Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100688	Medium 6.5	Budibase server before 3.45.0 Cross-Tenant Information Disclosure Assigned by VulnCheck	Sep 26, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.