CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 11:23 UTC)

What this means for you

This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,500; Show in the list
Critical, last 7 days: 358; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product budibase:server. Show all products

24 CVEs, showing 1 to 24

CVE	Severity	Title	Published
CVE-2026-100688	Medium 6.5	Budibase server before 3.45.0 Cross-Tenant Information Disclosure Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100687	Medium 5.5	Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100686	High 8.1	Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100685	High 7.7	Budibase before 3.45.0 Information Disclosure via Chat Links Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100684	High 8.1	Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100683	High 8.0	Budibase before 3.45.0 SQL Injection via column-rename DDL Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100682	High 8.8	Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100681	Medium 5.4	Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook Assigned by VulnCheck	Sep 26, 2026
CVE-2026-100680	High 8.1	Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import Assigned by VulnCheck	Sep 26, 2026
CVE-2026-82246	High 7.1	Budibase Server before 3.41.3 SSRF via Query Import Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82245	High 8.1	Budibase before 3.41.3 Missing Authorization License Management Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82244	Critical 9.1	Budibase before 3.41.3 Remote Code Execution via Plugin eval() Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82243	High 7.6	Budibase Server before 3.41.3 SSRF with Credential Leakage Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82242	High 7.7	Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82241	High 7.1	Budibase backend-core SSRF via incomplete default blacklist Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82240	High 8.1	Budibase before 3.41.3 Privilege Escalation via User Update API Assigned by VulnCheck	Aug 28, 2026
CVE-2026-82239	High 8.1	Budibase before 3.41.3 Authorization Bypass via datasources/query Assigned by VulnCheck	Aug 28, 2026
CVE-2026-72859	High 7.7	Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL Assigned by VulnCheck	Aug 14, 2026
CVE-2026-72855	High 8.5	Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST Assigned by VulnCheck	Aug 13, 2026
CVE-2026-72851	Critical 10.0	Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook Assigned by VulnCheck	Aug 13, 2026
CVE-2026-72850	Critical 9.1	Budibase before 3.40.0 Arbitrary File Write via Path Traversal Assigned by VulnCheck	Aug 13, 2026
CVE-2026-72849	High 7.7	Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF Assigned by VulnCheck	Aug 13, 2026
CVE-2026-73618	High 8.3	Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter Assigned by VulnCheck	Aug 13, 2026
CVE-2026-73617	High 7.1	Budibase before 3.40.0 NoSQL Injection via MongoDB datasource Assigned by VulnCheck	Aug 13, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.