Budibase

Records91All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical19CVSS 9.0–10.0

CVSS high57CVSS 7.0–8.9

Exploited now

Budibase records in CISA KEV

No Budibase vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Budibase 25 records HIGH

Records

25 records in Budibase · all components

TI-2026-39242 CVE-2026-54350 · GHSA-8qv3-p479-cj62

Budibase: Anonymous NoSQL operator injection via published-app query templates

HIGH 82

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00538 Published 2026-06-26 Fixed in 3.39.12 CWE-89

TI-2026-24369 CVE-2026-31816

Budibase Universal Auth Bypass via Webhook Query Param Injection

HIGH 80

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.16683 Published 2026-03-09 No fix listed CWE-74

TI-2026-39244 CVE-2026-54352 · GHSA-w7mq-r738-x278

Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

HIGH 76

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00494 Published 2026-06-26 Fixed in 3.39.9 CWE-22

TI-2026-39243 CVE-2026-54351 · GHSA-rgvg-3wpc-h44p

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

HIGH 76

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00461 Published 2026-06-26 Fixed in 3.39.9 CWE-915

TI-2026-24371 CVE-2026-31818 · GHSA-7r9j-r86q-7g45

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

HIGH 76

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00383 Published 2026-04-03 Fixed in 3.33.4 CWE-1188

TI-2026-23473 CVE-2026-30240

Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets

HIGH 76

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00292 Published 2026-03-09 No fix listed CWE-22

TI-2026-22078 CVE-2026-27702 · GHSA-rvhr-26g4-p2r8

Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

HIGH 76

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00391 Published 2026-02-25 Fixed in 3.30.4 CWE-20

TI-2026-27369 CVE-2026-35216 · GHSA-fcm4-4pj2-m5hf

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

HIGH 74

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.10904 Published 2026-04-03 Fixed in 3.33.4 CWE-78

TI-2026-20805 CVE-2026-25737

Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

HIGH 74

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00308 Published 2026-03-09 No fix listed CWE-602

TI-2026-27371 CVE-2026-35218

Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette

HIGH 73

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00335 Published 2026-04-03 Fixed in 3.32.5 CWE-79

TI-2026-25645 CVE-2026-33226 · GHSA-4647-wpjq-hh7f

Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

HIGH 73

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00381 Published 2026-03-20 No fix listed CWE-918

TI-2026-20229 CVE-2026-25045

Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

HIGH 73

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0034 Published 2026-03-09 No fix listed CWE-862

TI-2026-30027 CVE-2026-41428 · GHSA-8783-3wgf-jggf

Improper authentication in budibase

HIGH 72

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00445 Published 2026-04-24 Fixed in 3.35.4 CWE-287

TI-2026-20227 CVE-2026-25043

Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding

HIGH 72

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00302 Published 2026-04-03 Fixed in 3.23.25 CWE-770

TI-2026-36908 CVE-2026-50137 · GHSA-35c4-rvc8-frhm

Missing authorization in budibase

HIGH 71

Budibase is an open-source low-code platform.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00415 Published 2026-06-26 Fixed in 3.39.0 CWE-862

TI-2026-27367 CVE-2026-35214 · GHSA-2wfh-rcwf-wh23

Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

HIGH 71

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00564 Published 2026-04-03 Fixed in 3.33.4 CWE-22

TI-2026-39245 CVE-2026-54353 · GHSA-gfq7-5x4g-3xhf

Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation

HIGH 70

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00213 Published 2026-06-26 Fixed in 3.39.9 CWE-367

TI-2026-30560 CVE-2026-42239 · GHSA-4f9j-vr4p-642r

Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

HIGH 70

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00283 Published 2026-05-07 Fixed in 3.35.10 CWE-1004

TI-2026-36903 CVE-2026-50132 · GHSA-v7j5-vc4m-723w

Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase

HIGH 67

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00192 Published 2026-06-26 Fixed in 3.39.0 CWE-284

TI-2026-36907 CVE-2026-50136 · GHSA-jj36-r9w3-3pfh

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

HIGH 66

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.0029 Published 2026-06-26 Fixed in 3.39.3, 3.39.2 CWE-306

TI-2023-13471 CVE-2023-29010

BudiBase Server-Side Request Forgery vulnerability

MEDIUM 62

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00647 Published 2023-04-06 Fixed in 2.4.3 CWE-918

TI-2026-20228 CVE-2026-25044 · GHSA-gjw9-34gf-rp6m

Budibase: Command Injection in Bash Automation Step

MEDIUM 46

Budibase is an open-source low-code platform.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00474 Published 2026-04-03 Fixed in 3.33.4 CWE-78

TI-2026-20226 CVE-2026-25041 · GHSA-726g-59wr-cj4c

Budibase has a Command Injection in PostgreSQL Dump Command

MEDIUM 40

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00546 Published 2026-03-09 Fixed in 3.23.32 CWE-78

TI-2022-02980 CVE-2022-3225 · GHSA-x92g-49gh-63qm

Improper Control of Dynamically-Managed Code Resources in budibase/budibase

MEDIUM 40

Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00959 Published 2022-09-16 Fixed in 1.3.20 CWE-913

TI-2026-20225 CVE-2026-25040

Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role

LOW 26

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00568 Published 2026-01-29 No fix listed CWE-863

Open these records in search →