CVE-2026-66140

creationtimestamp| type| source ---|---|--- 2026-07-25 11:00:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhpmrowqe2d...

CVE-2026-14603

creationtimestamp| type| source ---|---|--- 2026-07-25 10:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhmbkn5gq2e...

CVE-2026-49744

creationtimestamp| type| source ---|---|--- 2026-07-25 09:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhiwmjagk2d...

GHSA-3R53-75J5-3G7J

creationtimestamp| type| source ---|---|--- 2026-07-25 06:31:04+00:00| seen| https://gist.github.com/alon710/31362352a2fade2501771882d0062b85...

CVE-2026-61892

creationtimestamp| type| source ---|---|--- 2026-07-25 00:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrgkqha7la22...

CVE-2026-48144

creationtimestamp| type| source ---|---|--- 2026-07-24 23:22:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgin3c4se24 2026-07-27 14:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn2pfmtd62e 2026-07-28 14:37:06+00:00| seen|...

CVE-2026-64212

creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:48+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116977339433684369 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-66138

creationtimestamp| type| source ---|---|--- 2026-07-24 22:33:31+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgfv6yufv25...

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

Summary The fix for GHSA-rwj8-pgh3-r573 stopped Repo.clonefrom from running caller-supplied URLs through os.path.expandvars, but it guarded only that one caller. Remote.create — reached from the public Repo.createremote and its Remote.add alias — still passes an attacker-influenceable URL through...

GHSA-94P4-4CQ8-9G67 GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

Summary The fix for GHSA-rwj8-pgh3-r573 stopped Repo.clonefrom from running caller-supplied URLs through os.path.expandvars, but it guarded only that one caller. Remote.create — reached from the public Repo.createremote and its Remote.add alias — still passes an attacker-influenceable URL through...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the uploadUrl function when processing attachment column values during AI table generation. An attacker can access internal network resources and sensitive...

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase: SSRF via bare fetch in uploadUrl during AI table generation Summary The uploadUrl function in packages/server/src/utilities/fileUtils.ts uses a bare fetchurl call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-generated attachmen...

GHSA-HFHX-W8P8-4HC7 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase: SSRF via bare fetch in uploadUrl during AI table generation Summary The uploadUrl function in packages/server/src/utilities/fileUtils.ts uses a bare fetchurl call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-generated attachmen...

CVE-2021-22439

creationtimestamp| type| source ---|---|--- 2026-07-24 21:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrgcqctujh2c...

Information Exposure

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Information Exposure via the rest integration process. An attacker can obtain sensitive authentication credentials by supplying a crafted absolute URL...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the rest integration process. An attacker can obtain sensitive authentication credentials by supplying a crafted absolute URL as a query parameter, causing the system to...

Information Exposure

Overview @budibase/types is a Budibase types Affected versions of this package are vulnerable to Information Exposure via the rest integration process. An attacker can obtain sensitive authentication credentials by supplying a crafted absolute URL as a query parameter, causing the system to forwa...

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

Impact In Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any BASIC app user to obtain S3 PutObject presigned URLs. The endpoint uses TABLE/WRITE permission level instead of the intended BUILDER level defined in v3.39.3. Additionally, the...

GHSA-XCX6-4F2G-HHGX Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

Impact In Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any BASIC app user to obtain S3 PutObject presigned URLs. The endpoint uses TABLE/WRITE permission level instead of the intended BUILDER level defined in v3.39.3. Additionally, the...

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Summary The administrator-configured WEBFETCHFILTERLIST the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch matches hostnames incorrectly, so the filter can be bypassed. Details isstringallowed backend/openwebui/utils/misc.py match...