Security advisories

critical2026-07-24

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

budibase/budibase · GHSA-mqhr-6j6h-74p5

medium2026-07-24

CVE-2026-62323-Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

cloudreve/cloudreve · GHSA-c3jm-gv5r-9wcp

critical2026-07-24

CVE-2026-73302- Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

budibase/budibase · GHSA-hp6v-6jw7-gv2f

high2026-07-24

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

budibase/budibase · GHSA-xg5g-26x8-cvf4

high2026-07-24

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

budibase/budibase · GHSA-xcx6-4f2g-hhgx

high2026-07-24

CVE-2026-73409- Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

budibase/budibase · GHSA-ppr4-5f46-j9c6

critical2026-07-24

CVE-2026-73300- Budibase: SQL Injection via `multipleStatements: true`

budibase/budibase · GHSA-q6x4-v3qx-85qw

high2026-07-24

CVE-2026-73303- Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

budibase/budibase · GHSA-c8vc-7pv3-g98p

medium2026-07-24

CVE-2026-73304- Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

budibase/budibase · GHSA-fcrw-f7gg-6g9f

medium2026-07-24

CVE-2026-73301- Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

budibase/budibase · GHSA-4qcj-m5wp-jmf4

high2026-07-24

CVE-2026-73305- Budibase: Privilege escalation via public role assignment API missing app-level authorization

budibase/budibase · GHSA-j9fc-w3mr-x6mv

high2026-07-24

CVE-2026-44907-react-server-dom: Denial of Service in Server Functions

react/react · GHSA-wx67-qw84-cm4g

critical2026-07-24

CVE-2026-62379-OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

openidentityplatform/openam · GHSA-wg5r-wc3x-39vc

medium2026-07-24

CVE-2026-62280-OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

openidentityplatform/openam · GHSA-vqxv-6xrh-49cp

critical2026-07-24

CVE-2026-62263-OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

openidentityplatform/openam · GHSA-gf8h-gq53-288j

high2026-07-24

CVE-2026-59221-open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

open-webui/open-webui · GHSA-frvj-c5qp-xj4w

medium2026-07-24

CVE-2026-59225-Open WebUI: Arena task endpoints can bypass underlying model access controls

open-webui/open-webui · GHSA-m3qf-58wf-w979

medium2026-07-24

CVE-2026-59212-Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

open-webui/open-webui · GHSA-2xwm-4h2q-ggfx

high2026-07-24

CVE-2026-59224-Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

open-webui/open-webui · GHSA-j657-m4c4-24jq

medium2026-07-24

CVE-2026-59223-Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

open-webui/open-webui · GHSA-qg3f-8x3j-ggf2