The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total49,796
Mitigations16,024
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@budibase/server<= 3.38.1
NPM: Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
4.9
15 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: SSRF via DNS rebinding in the REST datasource integration
8.5
15 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
7.1
16 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: Account Enumeration via Login Lockout Response Differential
5.3
17 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
7.7
17 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
7.6
34 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
8.3
34 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
5.7
35 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
7.5
35 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
0
37 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
9
42 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
8.5
42 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
7.7
43 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
7
43 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: SQL Injection via `multipleStatements: true`
9.6
45 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
0
45 minutes ago
@budibase/server< 3.39.25
NPM: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
4.9
45 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
4.3
47 minutes ago
@budibase/server<= 3.38.1
NPM: Budibase: Privilege escalation via public role assignment API missing app-level authorization
8.8
47 minutes ago
react-server-dom-webpack>= 19.0.0, < 19.0.8
NPM: react-server-dom: Denial of Service in Server Functions
7.5
48 minutes ago