Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure in the handling of the tlsCertificateKeyFile and tlsCAFile fields, which are passed directly as filesystem paths to the MongoDB driver without validation or restriction. An...

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

Summary When creating a MongoDB datasource, Budibase passes the tlsCertificateKeyFile and tlsCAFile fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths...

GO-2026-5327 Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver

Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver...

CVE-2026-13065

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:38+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13064

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:36+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13063

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:33+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13062

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:31+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13061

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:28+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13060

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:26+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13058

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:21+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13057

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:18+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13056

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:16+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13055

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:13+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13073

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:11+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13077

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:03+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13076

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:00+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13075

creationtimestamp| type| source ---|---|--- 2026-07-24 04:45:58+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13074

creationtimestamp| type| source ---|---|--- 2026-07-24 04:45:55+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-9737

creationtimestamp| type| source ---|---|--- 2026-07-24 04:45:53+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-13071

creationtimestamp| type| source ---|---|--- 2026-07-24 04:45:48+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...