Security feed

25 October 2026

advisoryCriticalOfficial CVE List25 Oct 2026

Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating an invite code and without an email_verified check (the email_verified gate protects only the existing-account lookup). An attacker who can register at an IdP that the tenant trusts for OIDC and assert a victim's invited email address (even with email_verified=false) claims the pending invite and inherits all of its granted privileges, including builder and admin.global, with no admin exclusion. This results in takeover of the invited principal and, for admin invites, full tenant compromise (access to all apps, datasources including production credentials, and automations); the invite is consumed, denying onboarding to the legitimate invitee.

Announced 26 Sept 2026

server CVE-2026-100684

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100684

server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100684
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #12673 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:11:50 GMT
Publisher date: Sat, 26 Sep 2026 13:23:45 GMT

Read the original announcement

advisoryHighOfficial CVE List25 Oct 2026

Budibase before 3.45.0 SQL Injection via column-rename DDL

Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename literal for MSSQL) without applying the project's quoteMySqlIdentifier / quoteSqlServerIdentifier helpers. An attacker with DDL rights on a connected MySQL/MSSQL datasource can create a column whose name contains a backtick (MySQL) or single quote (MSSQL) plus additional SQL; Budibase's schema introspection stores the name verbatim, and when a Budibase builder later renames that column through the UI (POST /api/tables with _rename.old), the embedded quote character terminates the identifier and the injected SQL is executed. Because the MySQL connection is opened with multipleStatements: true, stacked statements run as Budibase's datasource user, allowing arbitrary reads, writes, or destructive operations on the connected database outside Budibase's row/table permission model. Fixed in 3.45.0.

Announced 26 Sept 2026

server CVE-2026-100683

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100683

server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100683
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #12672 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:11:49 GMT
Publisher date: Sat, 26 Sep 2026 13:23:44 GMT

Read the original announcement

advisoryMediumOfficial CVE List25 Oct 2026

Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.

Announced 26 Sept 2026

server CVE-2026-100681

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100681

server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100681
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #12671 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:11:49 GMT
Publisher date: Sat, 26 Sep 2026 13:23:43 GMT

Read the original announcement

advisoryHighOfficial CVE List25 Oct 2026

Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.

Announced 26 Sept 2026

server CVE-2026-100682

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100682

server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100682
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #12670 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:11:48 GMT
Publisher date: Sat, 26 Sep 2026 13:23:43 GMT

Read the original announcement

advisoryHighOfficial CVE List25 Oct 2026

Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.

Announced 26 Sept 2026

server CVE-2026-100680

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100680

server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100680
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #12668 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:11:47 GMT
Publisher date: Sat, 26 Sep 2026 13:23:42 GMT

Read the original announcement

24 October 2026

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-9226

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.

Announced 6 Oct 2026

Server CVE-2026-9226

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-9226

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-9226
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #11915 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:59:00 GMT
Publisher date: Tue, 06 Oct 2026 18:17:01 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-105488

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.

Announced 6 Oct 2026

Server CVE-2026-105488

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-105488

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-105488
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #11900 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:58:51 GMT
Publisher date: Tue, 06 Oct 2026 18:20:11 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-105485

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.

Announced 6 Oct 2026

Server CVE-2026-105485

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-105485

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-105485
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9526 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:28 GMT
Publisher date: Tue, 06 Oct 2026 18:18:19 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.

Announced 29 Sept 2026

Server CVE-2026-93332

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93332

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-93332
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4930 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:00:29 GMT
Publisher date: Tue, 29 Sep 2026 15:29:20 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-100288

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records.

Announced 29 Sept 2026

Server CVE-2026-100288

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100288

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100288
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4884 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:59:13 GMT
Publisher date: Tue, 29 Sep 2026 15:46:27 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

Announced 29 Sept 2026

Server CVE-2026-100287

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100287

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100287
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3829 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:41:10 GMT
Publisher date: Tue, 29 Sep 2026 15:38:53 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.

Announced 29 Sept 2026

Server CVE-2026-100286

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100286

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100286
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3828 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:41:10 GMT
Publisher date: Tue, 29 Sep 2026 15:33:56 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.

Announced 29 Sept 2026

Server CVE-2026-100289

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100289

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-100289
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3819 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:41:04 GMT
Publisher date: Tue, 29 Sep 2026 15:48:33 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

CVE-2026-93330

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

Announced 29 Sept 2026

Server CVE-2026-93330

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93330

Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-93330
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3783 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:40:42 GMT
Publisher date: Tue, 29 Sep 2026 15:25:16 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.

Announced 21 Sept 2026

server CVE-2026-58271

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-58271

server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-58271
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #1961 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:10:50 GMT
Publisher date: Mon, 21 Sep 2026 19:50:14 GMT

Read the original announcement

advisoryHighOfficial CVE List24 Oct 2026

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.

Announced 21 Sept 2026

server CVE-2026-58269

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-58269

server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-58269
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #1957 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:10:48 GMT
Publisher date: Mon, 21 Sep 2026 20:01:56 GMT

Read the original announcement