CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...

CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...

CVE-2026-82243

Budibase Server before 3.41.3 is affected by a server-side request forgery (SSRF) vulnerability in the datasource verify endpoint . The root cause is that builder-level users can supply arbitrary URLs without SSRF validation, allowing them to make server-side requests to attacker-controlled hosts...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

EUVD-2026-67692

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

EUVD-2026-67691

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...

CVE-2026-82239

Budibase versions before 3.41.3 are affected by an authorization bypass in the POST /api/datasources/query endpoint. The failure to enforce per-table role restrictions allows users with the low-privilege BASIC role to submit crafted query requests targeting arbitrary table identifiers, enabling t...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82239 Budibase before 3.41.3 Authorization Bypass via datasources/query

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...

EUVD-2026-67688

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication...

CVE-2026-82236 File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication...

CVE-2026-82236

File Browser versions 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. An unauthenticated attacker who possesses the surviving share link can retrieve new, unrelated content subsequently uploaded to the same path. The CVSS 3.1 s...

CVE-2026-82236 File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication...

EUVD-2026-67686

SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the httprequest and webfetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public...

CVE-2026-82233

SiYuan before v3.8.1 is affected by a path traversal vulnerability in the asset.upload MCP tool , which accepts arbitrary absolute file paths without workspace boundary validation. An attacker can leverage prompt injection to induce the AI Agent to upload sensitive files—such as SSH keys or crede...

CVE-2026-81732

WWBN AVideo through version 30.0 contains an information disclosure vulnerability caused by missing authentication on the report4.json.php and report4.1.json.php endpoints. An unauthenticated attacker can issue GET requests to retrieve daily and cumulative user-registration counts without any ses...

CVE-2026-81732 WWBN AVideo through 30.0 Information Disclosure via report4.json.php

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts...

CVE-2026-81732 WWBN AVideo through 30.0 Information Disclosure via report4.json.php

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts...

CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...

CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...