https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-54353.htmlhttps://patchthecve.com/cve/CVE-2026-54353.htmlTue, 30 Jun 2026 20:05:11 +0000HIGH 8.5: Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connection lhttps://patchthecve.com/cve/CVE-2026-54352.htmlhttps://patchthecve.com/cve/CVE-2026-54352.htmlTue, 30 Jun 2026 20:00:57 +0000CRITICAL 9.6: Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with extract-zip@2.0.1 into a temp directory, then for each entry listed in icons.json validates the icon path, openshttps://patchthecve.com/cve/CVE-2026-54351.htmlhttps://patchthecve.com/cve/CVE-2026-54351.htmlTue, 30 Jun 2026 19:52:17 +0000HIGH 8.2: Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internalhttps://patchthecve.com/cve/CVE-2026-54350.htmlhttps://patchthecve.com/cve/CVE-2026-54350.htmlTue, 30 Jun 2026 20:17:30 +0000CRITICAL 10.0: Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write queryhttps://patchthecve.com/cve/CVE-2026-50137.htmlhttps://patchthecve.com/cve/CVE-2026-50137.htmlTue, 30 Jun 2026 19:49:18 +0000CRITICAL 9.4: Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id (app_...) and an S3-source datasource id (ds_...) can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endphttps://patchthecve.com/cve/CVE-2026-50136.htmlhttps://patchthecve.com/cve/CVE-2026-50136.htmlTue, 30 Jun 2026 19:40:07 +0000HIGH 7.4: Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authenhttps://patchthecve.com/cve/CVE-2026-50132.htmlhttps://patchthecve.com/cve/CVE-2026-50132.htmlTue, 30 Jun 2026 19:26:42 +0000HIGH 7.3: Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user acc