{"vulnerability": "CVE-2026-72851", "sightings": [{"uuid": "f846da64-6750-4b0e-b7de-60c8283d8b17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72851", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mszg7ve2hq2g", "content": "Daily IT Security Digest \u2014 2026-08-14\n(CVSS 9.4) is a path traversal bug allowing authenticated builders to write files outside designated temp directories. CVE-2026-72851 (SQL injection) enables unauthenticated attackers to run arbitrary SQL queries on connected datasources like Snowflake via", "creation_timestamp": "2026-08-14T05:25:17.789595Z"}, {"uuid": "438fa4a6-458e-4503-8a60-58391a7b52f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72851", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mszg7v3tdq2j", "content": "Daily IT Security Digest \u2014 2026-08-14\n# Daily IT Security Digest \u2014 2026-08-14\n\n## Top Cybersecurity News Today\n\n### 1. Budibase Server Hit by Dual Critical Vulnerabilities (CVE-2026-72850, CVE-2026-72851)\nTwo critical flaws in Budibase server versions below 3.40.0 demand immediate attention.", "creation_timestamp": "2026-08-14T05:25:17.349992Z"}, {"uuid": "843696c6-94f1-4fb9-aec7-1ed35ced3c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72851", "type": "seen", "source": "Telegram/hhF5X9l-443ICg7ZpS9-uwcd7Zf9SpAraBV0rI1xxNpeeM0", "content": "", "creation_timestamp": "2026-08-15T08:00:05.492468Z"}, {"uuid": "865730e6-d581-41de-8de3-dda33ea06cfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72851", "type": "published-proof-of-concept", "source": "Telegram/hhF5X9l-443ICg7ZpS9-uwcd7Zf9SpAraBV0rI1xxNpeeM0", "content": "", "creation_timestamp": "2026-08-16T00:00:46.338900Z"}, {"uuid": "bba304e4-3091-445e-b647-18c02ecff6bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72851", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyqp4lx6j2j", "content": "CVE-2026-72851 - server\nBudibase, a low-code platform, has a security issue that allows attackers to inject malicious SQL code without being authenticated. This could lead to sensitive data being stolen,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#server #budibase #CVE #infosec", "creation_timestamp": "2026-08-13T23:00:10.497374Z"}, {"uuid": "227b98aa-3bf1-4d27-85f3-29e173e0d911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72851", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117091626314475860", "content": "Budibase server <3.40.0 hit by CRITICAL SQL injection (CVE-2026-72851) in webhook-triggered EXECUTE_QUERY. Unauthenticated attackers can run arbitrary SQL on connected datasources (e.g., Snowflake). Patch managed by vendor. https://radar.offseq.com/threat/cve-2026-72851-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-1263010eb783b278 #OffSeq #SQLi #Budibase #Infosec", "creation_timestamp": "2026-08-14T03:00:28.108697Z"}, {"uuid": "203b7297-e8d6-41ea-9d1f-544fec5e9907", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72851", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msz64xmobv2t", "content": "Budibase server before 3.40.0 faces CRITICAL SQL injection (CVE-2026-72851) via webhook automations. Unauthenticated attackers can access and alter data. Vendor manages remediation \u2014 confirm your service is updated. https://radar.offseq.com/threat/cve-2026-72851-improper-neutralization-of-special...", "creation_timestamp": "2026-08-14T03:00:29.854906Z"}]}