VulnSocial

CVE-2026-82241Disclosure

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST) used by REST datasource query previews. When the default blacklist is active (i.e., a self-hosted deployment has not defined BLACKLIST_IPS), an authenticated user with the Builder permission can submit a REST datasource query preview request to POST /api/queries/preview targeting a reachable HTTP(S) service in the 100.64.0.0/10 range, causing the server to send a request to that target and return its response through the preview flow. Per the advisory, no released fix was identified at the time of publication; remediation is to add 100.64.0.0/10 to DEFAULT_BLACKLIST.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-28: 1Technical Details · 2026-08-28: 108-28
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • NewNormal Security@NewScanTeam
    Disclosure

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 28 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🚨 Outdated ownCloud — WebDAV answers with no login, so a known username is enough to read or delete their files, or a leftover test file prints the admin password, as seen in ownCloud CVE-2023-49105, CVE-2023-49103 ⚡ Outdated Budibase — an uploaded plugin runs as code, and low-privilege users reach data and roles their app denies them, as seen in Budibase CVE-2026-82244, CVE-2026-82239, CVE-2026-82240, CVE-2026-82241, CVE-2026-82242, CVE-2026-82243, CVE-2026-82245, CVE-2026-82246 📦 FileBrowser with no maintainer left — a named pipe in a shared folder hangs downloads, and no fix will ever ship, as seen in FileBrowser CVE-2026-82235, CVE-2026-82237, CVE-2026-82238 Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM

    Post summary

    The post delivers a daily CVE report highlighting newly detected vulnerabilities in outdated ownCloud, Budibase, and FileBrowser, providing technical details but no PoC, exploit code, or patch information.

    0000071
    6 followersView on X

Explore more

Back to dashboard