Exploit for Improper Neutralization of Special Elements in Data Query Logic in Budibase

CVE-2026-54350 — Budibase Unauthenticated NoSQL Operator Injec...

GHSA-8QV3-P479-CJ62 Budibase has nonymous NoSQL operator injection via published-app query templates

Summary enrichContext at packages/server/src/sdk/workspace/queries/queries.ts:121-138 substitutes parameter values into the raw JSON body of a query, then JSON.parses the result. The validator validateQueryInputs at packages/server/src/api/controllers/query/index.ts:61-71 rejects only Handlebars...

CVE-2026-33532

yaml is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of yaml on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a...

CVE-2026-1514

Technical details are not publicly available in the provided documents (no affected version, patch info, or exploit details). Monitor for updates.

PT-2026-5056

Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to modify front-end code to read all official documents...

2100 Technology Official Document Management System Security Vulnerabilities

The 2100 Technology Official Document Management System is a document management software developed by 2100 Technology in Taiwan, China. The 2100 Technology Official Document Management System has a security vulnerability, which stems from improper authorization. This vulnerability could allow...

XWiki Platform Security Vulnerability

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in Xwiki versions 6.3-milestone-2 through 14.10.15 and 15.0-rc-1 through 15.5.1, which stems from disclosing the content of all documents to...