BuddyBoss
Vulnerability activity for BuddyBoss: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.8HighNov 3, 2026BuddyBoss App Path traversal / file handlingCVE-2026-76124The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possi
- 8.8HighOct 29, 2026Buddyboss Platform Privilege escalationCVE-2026-118082Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
- 9.8CriticalJun 26, 2026Buddyboss Platform DeserializationCVE-2026-56032Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.
Top products
- Buddyboss Platform2 CVEs in the last year, 1 critical
- BuddyBoss App1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.