GHSA-3GP5-Q4JW-3V94 Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL

Summary Budibase stores external REST datasource credentials server-side and documents that database credentials are applied server-side and are not exposed in the UI. The REST datasource implementation redacts stored Basic/Bearer/OAuth2 auth secrets before returning datasource data to clients...

PT-2026-44063

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0 Description Budibase is an open-source low-code platform where the GET and PUT routes for single-datasources are guarded by generic TABLE READ permissions instead of Builder/Admin permissions or...

CVE-2025-7115

A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/fileId/route.ts of the component Session Handler. The manipulation of the argument...