Skip to content
Noroxi

Budibase records

25 published records for vendor Budibase.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
72%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 22
  2. 23
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

25 records
  • CVE-2026-31816
    41Plan

    Budibase Universal Auth Bypass via Webhook Query Param Injection

    CriticalCVSS 9.1Proof of conceptEPSS 16%

    budibase · budibaseMar 9, 2026

  • CVE-2026-35216
    39Monitor

    Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

    CriticalCVSS 9.0No exploitEPSS 10%

    budibase · budibaseApr 3, 2026

  • CVE-2026-54350
    39Monitor

    Budibase: Anonymous NoSQL operator injection via published-app query templates

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    budibase · budibaseJun 26, 2026

  • CVE-2026-31818
    39Monitor

    Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

    CriticalCVSS 9.9No exploitEPSS 0%

    budibase · budibaseApr 3, 2026

  • CVE-2026-54352
    38Monitor

    Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

    CriticalCVSS 9.6No exploitEPSS 0%

    budibase · budibaseJun 26, 2026

  • CVE-2026-54351
    38Monitor

    Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

    CriticalCVSS 9.6No exploitEPSS 0%

    budibase · budibaseJun 26, 2026

  • CVE-2026-41428
    36Monitor

    Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

    CriticalCVSS 9.1No exploitEPSS 0%

    budibase · budibaseApr 24, 2026

  • CVE-2026-27702
    36Monitor

    Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

    CriticalCVSS 9.0No exploitEPSS 0%

    budibase · budibaseFeb 25, 2026

  • CVE-2026-25737
    36Monitor

    Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

    CriticalCVSS 9.0No exploitEPSS 0%

    budibase · budibaseMar 9, 2026

  • CVE-2026-35214
    34Monitor

    Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

    HighCVSS 8.7No exploitEPSS 0%

    budibase · budibaseApr 3, 2026

  • CVE-2026-25041
    34Monitor

    Budibase has a Command Injection in PostgreSQL Dump Command

    HighCVSS 8.6No exploitEPSS 0%

    budibase · budibaseMar 9, 2026

  • CVE-2026-25044
    34Monitor

    Budibase: Command Injection in Bash Automation Step

    HighCVSS 8.7No exploitEPSS 0%

    budibase · budibaseApr 3, 2026

  • CVE-2026-33226
    34Monitor

    Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

    HighCVSS 8.7No exploitEPSS 0%

    budibase · budibaseMar 20, 2026

  • CVE-2026-25045
    34Monitor

    Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

    HighCVSS 8.7No exploitEPSS 0%

    budibase · budibaseMar 9, 2026

  • CVE-2026-35218
    34Monitor

    Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette

    HighCVSS 8.7No exploitEPSS 0%

    budibase · budibaseApr 3, 2026

  • CVE-2026-50137
    32Monitor

    Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credenti

    HighCVSS 8.2No exploitEPSS 0%

    budibase · budibaseJun 26, 2026

  • CVE-2026-30240
    32Monitor

    Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets

    HighCVSS 8.1No exploitEPSS 0%

    budibase · budibaseMar 9, 2026

  • CVE-2026-42239
    32Monitor

    Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

    HighCVSS 8.1No exploitEPSS 0%

    budibase · budibaseMay 7, 2026

  • CVE-2026-25043
    30Monitor

    Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding

    HighCVSS 7.5No exploitEPSS 0%

    budibase · budibaseApr 3, 2026

  • CVE-2026-50132
    29Monitor

    Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase

    HighCVSS 7.3No exploitEPSS 0%

    budibase · budibaseJun 26, 2026

  • CVE-2026-54353
    28Monitor

    Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation

    HighCVSS 7.1No exploitEPSS 0%

    budibase · budibaseJun 26, 2026

  • CVE-2023-29010
    26Monitor

    BudiBase Server-Side Request Forgery vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    budibase · budibaseApr 6, 2023

  • CVE-2022-3225
    22Monitor

    Improper Control of Dynamically-Managed Code Resources in budibase/budibase

    MediumCVSS 5.7No exploitEPSS 1%

    budibase · budibaseSep 16, 2022

  • CVE-2026-25040
    22Monitor

    Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role

    MediumCVSS 5.7No exploitEPSS 0%

    budibase · budibaseJan 29, 2026

  • CVE-2026-50136
    21Monitor

    Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

    MediumCVSS 5.3No exploitEPSS 0%

    budibase · budibaseJun 26, 2026