How many budibase @budibase/backend-core CVEs are in CISA KEV?

None of budibase @budibase/backend-core's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of budibase @budibase/backend-core are affected?

11 distinct budibase @budibase/backend-core versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in budibase @budibase/backend-core CVEs?

budibase @budibase/backend-core's CVEs most often map to these CWE weakness types: CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag), CWE-1188 (Initialization of a Resource with an Insecure Default), CWE-269 (Improper Privilege Management), CWE-287 (Improper Authentication).

How many critical budibase @budibase/backend-core vulnerabilities are there?

budibase @budibase/backend-core has 2 critical and 2 high-severity CVEs.

What is the average severity of budibase @budibase/backend-core CVEs?

The average CVSS base score across budibase @budibase/backend-core's scored CVEs is 7.7.

budibase @budibase/backend-core Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: budibase @budibase/backend-core vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

budibase @budibase/backend-core Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

budibase @budibase/backend-core has 6 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 6 have a known public exploit. The average CVSS base score across scored CVEs is 7.7.

This page aggregates every publicly disclosed vulnerability (CVE) affecting budibase @budibase/backend-core, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of budibase @budibase/backend-core's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High2

Medium2

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of budibase @budibase/backend-core's CVEs are currently listed in CISA's KEV catalog.

Public exploits

6 of budibase @budibase/backend-core's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every budibase @budibase/backend-core version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 3.33.41 CVE
< 3.35.101 CVE
< 3.35.41 CVE
< 3.38.21 CVE
< 3.39.91 CVE
<= 3.35.31 CVE

Fixed in

3.33.41 CVE
3.35.101 CVE
3.35.41 CVE
3.38.21 CVE
3.39.91 CVE

Find a version

6 CVEs

Sort

Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation
CVE-2026-54353
Public exploit
Patch
CWE-367
High · CVSS 8.5
EPSS 0.2% (11th pct)2026-06-26
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
CVE-2026-48147
Public exploit
Patch
CWE-352
Medium · CVSS 6.5
EPSS 0.1% (2th pct)2026-05-27
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
CVE-2026-46424
Public exploit
Patch
CWE-269
Medium · CVSS 4.2
EPSS 0.2% (6th pct)2026-05-27
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
CVE-2026-42239
Public exploit
Patch
CWE-1004
High · CVSS 8.1
EPSS 0.3% (20th pct)2026-05-07
Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
CVE-2026-41428
Public exploit
Patch
CWE-287
Critical · CVSS 9.1
EPSS 0.4% (37th pct)2026-04-24
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
CVE-2026-31818
Public exploit
Patch
CWE-1188
Critical · CVSS 9.9
EPSS 0.4% (31th pct)2026-04-03

Common weakness types

The CWE weakness categories most often found in budibase @budibase/backend-core CVEs. Follow any weakness for its full explanation.

Other budibase products

Browse vulnerabilities for other products by budibase.

budibase81 CVEs @budibase/server34 CVEs server15 CVEs @budibase/worker2 CVEs @budibase/bbui1 CVEs budibase/budibase1 CVEs @budibase/builder1 CVEs

All budibase vulnerabilities

Frequently asked questions

Common questions about budibase @budibase/backend-core vulnerabilities.

How many CVEs does budibase @budibase/backend-core have?: budibase @budibase/backend-core has 6 published CVE records since 2026.
How many budibase @budibase/backend-core CVEs are in CISA KEV?: None of budibase @budibase/backend-core's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for budibase @budibase/backend-core vulnerabilities?: Yes — 6 of budibase @budibase/backend-core's CVEs have a known public exploit.
Which versions of budibase @budibase/backend-core are affected?: 11 distinct budibase @budibase/backend-core versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in budibase @budibase/backend-core CVEs?: budibase @budibase/backend-core's CVEs most often map to these CWE weakness types: CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag), CWE-1188 (Initialization of a Resource with an Insecure Default), CWE-269 (Improper Privilege Management), CWE-287 (Improper Authentication).
How many critical budibase @budibase/backend-core vulnerabilities are there?: budibase @budibase/backend-core has 2 critical and 2 high-severity CVEs.
What is the average severity of budibase @budibase/backend-core CVEs?: The average CVSS base score across budibase @budibase/backend-core's scored CVEs is 7.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track budibase @budibase/backend-core vulnerabilities

Monitor new budibase @budibase/backend-core vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing