# budibase server.

Every CVE that names budibase server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Budibase server before 3.45.0 Cross-Tenant Information Disclosure](https://agentprime.io/advisories/CVE-2026-100688.md)
  `CVE-2026-100688` · CVE record: budibase server · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast](https://agentprime.io/advisories/CVE-2026-100687.md)
  `CVE-2026-100687` · CVE record: budibase server · CVSS 7.0 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps](https://agentprime.io/advisories/CVE-2026-100686.md)
  `CVE-2026-100686` · CVE record: budibase server · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [Budibase before 3.45.0 Information Disclosure via Chat Links](https://agentprime.io/advisories/CVE-2026-100685.md)
  `CVE-2026-100685` · CVE record: budibase server · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC](https://agentprime.io/advisories/CVE-2026-100684.md)
  `CVE-2026-100684` · CVE record: budibase server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Budibase before 3.45.0 SQL Injection via column-rename DDL](https://agentprime.io/advisories/CVE-2026-100683.md)
  `CVE-2026-100683` · CVE record: budibase server · CVSS 8.9 High · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection
- [Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink](https://agentprime.io/advisories/CVE-2026-100682.md)
  `CVE-2026-100682` · CVE record: budibase server · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook](https://agentprime.io/advisories/CVE-2026-100681.md)
  `CVE-2026-100681` · CVE record: budibase server · CVSS 6.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import](https://agentprime.io/advisories/CVE-2026-100680.md)
  `CVE-2026-100680` · CVE record: budibase server · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [Budibase Server before 3.41.3 SSRF via Query Import](https://agentprime.io/advisories/CVE-2026-82246.md)
  `CVE-2026-82246` · CVE record: budibase server · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Budibase before 3.41.3 Missing Authorization License Management](https://agentprime.io/advisories/CVE-2026-82245.md)
  `CVE-2026-82245` · CVE record: budibase server · CVSS 7.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Broken access control
- [Budibase before 3.41.3 Remote Code Execution via Plugin eval()](https://agentprime.io/advisories/CVE-2026-82244.md)
  `CVE-2026-82244` · CVE record: budibase server · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Code injection
- [Budibase Server before 3.41.3 SSRF with Credential Leakage](https://agentprime.io/advisories/CVE-2026-82243.md)
  `CVE-2026-82243` · CVE record: budibase server · CVSS 8.3 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization](https://agentprime.io/advisories/CVE-2026-82242.md)
  `CVE-2026-82242` · CVE record: budibase server · CVSS 8.3 High · Not analysed yet · Published 28 Aug 2026 · Tags: Broken access control
- [Budibase backend-core SSRF via incomplete default blacklist](https://agentprime.io/advisories/CVE-2026-82241.md)
  `CVE-2026-82241` · CVE record: budibase server · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Budibase before 3.41.3 Privilege Escalation via User Update API](https://agentprime.io/advisories/CVE-2026-82240.md)
  `CVE-2026-82240` · CVE record: budibase server · CVSS 8.6 High · Not analysed yet · Published 28 Aug 2026 · Tags: Broken access control
- [Budibase before 3.41.3 Authorization Bypass via datasources/query](https://agentprime.io/advisories/CVE-2026-82239.md)
  `CVE-2026-82239` · CVE record: budibase server · CVSS 8.6 High · Not analysed yet · Published 28 Aug 2026 · Tags: Broken access control
- [Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook](https://agentprime.io/advisories/CVE-2026-72851.md)
  `CVE-2026-72851` · CVE record: budibase server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: SQL injection
- [Budibase before 3.40.0 Arbitrary File Write via Path Traversal](https://agentprime.io/advisories/CVE-2026-72850.md)
  `CVE-2026-72850` · CVE record: budibase server · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=budibase-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/budibase-server/>. Everything for agents: <https://agentprime.io/llms.txt>.