4455 matches found
EUVD-2026-58653
Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...
CVE-2026-72859
Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...
CVE-2026-72859
Budibase 3.39.4 before 3.40.0 contains an authorization regression in the S3 attachment upload endpoint. Affected component: the attachments endpoint used to generate S3 PutObject presigned URLs. Root cause: the route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC...
CVE-2026-66432
Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...
CVE-2026-61966
Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...
EUVD-2026-57865
Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...
CVE-2026-66432
CVE-2026-66432 affects the WordPress WPJAM Basic plugin, versions
CVE-2026-66432
Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...
CVE-2026-66432 WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...
CVE-2026-61966 WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability
Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...
CVE-2026-61966
Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...
EUVD-2026-57971
Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...
CVE-2026-61966
CVE-2026-61966 : Affected software is the WordPress WPJAM Basic plugin in versions ≤ 7.0.1. The vulnerability is a Subscriber SQL Injection in WPJAM Basic, with the underlying issue described across connected sources. The CVSS 3.1 base score is 9.3 (CRITICAL), with network attack vector, low atta...
Imperva API Security Token & Authentication Risk Report: Nearly 40% of APIs Face Multiple Authentication Risks
Every year, the security industry publishes benchmark reports built more or less the same way: pick a handful of common vulnerabilities, measure how often they show up, publish the percentages, and move on. We just finished our second year running one of those reports — and the most important thi...
CVE-2026-73301 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder...
CVE-2026-73301 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder...
CVE-2026-73301
CVE-2026-73301 (Budibase) describes a missing RBAC check on GET /api/global/groups in Budibase prior to 3.39.25. An authenticated BASIC user could enumerate tenant groups, role mappings, and user memberships, effectively exposing the tenant access-control structure to non-builder/ non-admin users...
CVE-2026-73245
Kestra, an open-source event-driven orchestration platform, prior to 2.0.0-rc6 exposed Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env to disclose resolved configuration and POST /loggers/{...
