@budibase/server vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54350Critical@budibase/server: Budibase has nonymous NoSQL operator injection via published-app query templatesCVE-2026-54352Critical@budibase/server: Budibase has arbitrary file read by workspace-builder via PWA-zip symlink uploadCVE-2026-54351High@budibase/server: Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId OverrideCVE-2026-50137High@budibase/server: Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored…CVE-2026-50136High@budibase/server: Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentialsCVE-2026-50132High@budibase/server: Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRFCVE-2026-48153High@budibase/server: Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadataCVE-2026-48152High@budibase/server: Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URLCVE-2026-48151High@budibase/server: Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schemaCVE-2026-48150Critical@budibase/server: Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assignCVE-2026-48148Medium@budibase/server: Budibase: Unvalidated VectorDB Host Parameter Enables SSRFCVE-2026-48146High@budibase/server: Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist ProtectionCVE-2026-45719Medium@budibase/server: Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API CVE-2026-45717High@budibase/server: Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any…CVE-2026-45715High@budibase/server: Budibase: SSRF Bypass via HTTP Redirect in REST Datasource IntegrationCVE-2026-45548High@budibase/server: Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist ValidationCVE-2026-35216Critical@budibase/server: Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation StepCVE-2026-35214High@budibase/server: Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file writeCVE-2026-25044High@budibase/server: Budibase: Command Injection in Bash Automation StepCVE-2026-25041High@budibase/server: @budibase/server: Command Injection in PostgreSQL Dump CommandGHSA-4G2X-VQ5P-5VJ6Critical@budibase/server: Budibase affected by VM2 Constructor Escape Vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo