PkgSeer

Vulnerabilities

Last updated 2 hours ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
budibase Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) High Risk 7.7 5 months ago 11 hours ago
@budibase/server Budibase: Unvalidated VectorDB Host Parameter Enables SSRF Medium Risk 6.0 4 months ago 1 month ago
@budibase/server Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation High Risk 7.7 5 months ago 1 month ago
@budibase/server Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API Medium Risk 6.5 5 months ago 1 month ago
@budibase/server Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL High Risk 8.8 5 months ago 1 month ago
@budibase/server Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL High Risk 8.1 4 months ago 1 month ago
@budibase/server Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema High Risk 7.5 4 months ago 1 month ago
@budibase/backend-core Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker Medium Risk 6.5 4 months ago 1 month ago
@budibase/server Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection High Risk 7.7 4 months ago 1 month ago
@budibase/server Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata High Risk 8.5 4 months ago 1 month ago
@budibase/server Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign Critical 9.0 4 months ago 1 month ago
@budibase/worker Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration High Risk 8.8 5 months ago 1 month ago
@budibase/server Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration High Risk 7.7 5 months ago 1 month ago
@budibase/backend-core Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour Medium Risk 4.2 5 months ago 1 month ago
@budibase/server Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` High Risk 7.1 2 months ago 2 months ago
budibase budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL High Risk 8.4 4 months ago 2 months ago
@budibase/server Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users Medium Risk 4.9 3 months ago 2 months ago
@budibase/server Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs High Risk 7.7 3 months ago 2 months ago
@budibase/server Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist High Risk 8.0 2 months ago 2 months ago
@budibase/server Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution High Risk 8.5 3 months ago 2 months ago
@budibase/server Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete High Risk 7.1 3 months ago 2 months ago
@budibase/server Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) High Risk 7.7 3 months ago 2 months ago
@budibase/server Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution High Risk 8.3 3 months ago 2 months ago
@budibase/server Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector High Risk 7.6 3 months ago 2 months ago
@budibase/server Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak Critical 9.5 3 months ago 2 months ago
@budibase/server Budibase: SSRF via DNS rebinding in the REST datasource integration High Risk 8.5 3 months ago 2 months ago
@budibase/server Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile High Risk 8.0 3 months ago 2 months ago
@budibase/server Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders Medium Risk 5.7 3 months ago 2 months ago
@budibase/server Budibase: SSRF via bare fetch() in uploadUrl during AI table generation Medium Risk 6.0 3 months ago 2 months ago
@budibase/server Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint High Risk 7.5 3 months ago 2 months ago
@budibase/server Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings Medium Risk 4.3 3 months ago 2 months ago
@budibase/server Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) High Risk 8.0 3 months ago 2 months ago
@budibase/server Budibase: Account Enumeration via Login Lockout Response Differential Medium Risk 5.3 3 months ago 2 months ago
@budibase/server Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified Critical 9.5 3 months ago 2 months ago
@budibase/server Budibase: Privilege escalation via public role assignment API missing app-level authorization High Risk 8.8 3 months ago 2 months ago
@budibase/server Budibase: SQL Injection via `multipleStatements: true` Critical 9.6 3 months ago 2 months ago
@budibase/server Budibase has nonymous NoSQL operator injection via published-app query templates Critical 10.0 4 months ago 2 months ago
@budibase/server Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload Critical 9.6 4 months ago 2 months ago
@budibase/backend-core @budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation High Risk 8.5 4 months ago 2 months ago
@budibase/server Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override High Risk 8.2 4 months ago 3 months ago
@budibase/server Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF High Risk 7.3 4 months ago 3 months ago
@budibase/server Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials Critical 9.4 4 months ago 3 months ago
@budibase/server Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials High Risk 7.4 4 months ago 3 months ago
budibase Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step Medium Risk 6.0 4 months ago 4 months ago
budibase Budibase: Unrestricted Upload of File with Dangerous Type High Risk 7.6 5 months ago 5 months ago
budibase Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows Medium Risk 5.4 5 months ago 5 months ago
@budibase/backend-core Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover High Risk 8.1 6 months ago 5 months ago
@budibase/backend-core Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints Critical 9.1 6 months ago 6 months ago
@budibase/server Budibase: Command Injection in Bash Automation Step High Risk 8.8 7 months ago 7 months ago
@budibase/server Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step Critical 9.0 7 months ago 7 months ago
Data courtesy of OSV.dev
Page 1