@budibase/server vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-35219High@budibase/server: Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP BlacklistCVE-2026-73307Medium@budibase/server: Budibase: SSRF via bare fetch() in uploadUrl during AI table generationCVE-2026-73410High@budibase/server: Budibase: SSRF via DNS rebinding in the REST datasource integrationGHSA-PMPG-2MXQ-6XWRHigh@budibase/server: Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/deleteCVE-2026-73306Medium@budibase/server: Budibase: Account Enumeration via Login Lockout Response DifferentialGHSA-PVCR-8MVP-W8QRHigh@budibase/server: Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)GHSA-2XGG-R2WC-C5R2High@budibase/server: Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database ConnectorGHSA-QW6M-8FW2-2V64High@budibase/server: Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query ExecutionCVE-2026-73308Medium@budibase/server: Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other BuildersCVE-2026-73406High@budibase/server: Budibase: Unauthenticated user information disclosure via public tenant user lookup endpointGHSA-MQHR-6J6H-74P5Critical@budibase/server: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak CVE-2026-73302Critical@budibase/server: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifiedGHSA-XG5G-26X8-CVF4High@budibase/server: Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query executionGHSA-XCX6-4F2G-HHGXHigh@budibase/server: Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLsCVE-2026-73409High@budibase/server: Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFileCVE-2026-73300Critical@budibase/server: Budibase: SQL Injection via `multipleStatements: true`CVE-2026-73303High@budibase/server: Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)CVE-2026-73304Medium@budibase/server: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role UsersCVE-2026-73301Medium@budibase/server: Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappingsCVE-2026-73305High@budibase/server: Budibase: Privilege escalation via public role assignment API missing app-level authorizationCVE-2026-54350Critical@budibase/server: Budibase has nonymous NoSQL operator injection via published-app query templatesCVE-2026-54352Critical@budibase/server: Budibase has arbitrary file read by workspace-builder via PWA-zip symlink uploadCVE-2026-54351High@budibase/server: Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId OverrideCVE-2026-50137High@budibase/server: Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored…CVE-2026-50136High@budibase/server: Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo