https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T09:31:03.276194+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-82242 fkie_cve-2026-82242 2026-09-29T09:31:03.278640+00:00

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

 https://vulnerability.circl.lu/vuln/ghsa-x7cc-r52j-8mj8 GHSA-x7cc-r52j-8mj8 2026-09-29T09:31:03.278715+00:00

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.