What’s Vulnerable › Products
chartbrew vulnerabilities
19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Check whether your chartbrew version is affected
Latest chartbrew vulnerabilities
- CVE-2026-65980 — Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution (CVSS 7.9)
- CVE-2026-61852 — Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool (CVSS 5.8)
- CVE-2026-61851 — Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool (CVSS 6.5)
- CVE-2026-61743 — Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation (CVSS 6.3)
- CVE-2026-41518 — Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) (CVSS 7.6)
- CVE-2026-40904 — Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks (CVSS 8.1)
- CVE-2026-40603 — Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override (CVSS 6.5)
- CVE-2026-40601 — Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle (CVSS 7.5)
- CVE-2026-40600 — Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id (CVSS 8.1)
- CVE-2026-40595 — Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks (CVSS 7.5)
- CVE-2026-35514 — Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew (CVSS 6.5)
- CVE-2026-32252 — Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` (CVSS 7.7)
- CVE-2026-30232 — Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs (CVSS 9.6)
- CVE-2026-27605 — Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API (CVSS 5.4)
- CVE-2026-27603 — Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions (CVSS 7.5)
- CVE-2026-27005 — Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) (CVSS 9.8)
- CVE-2026-25888 — Chartbrew: Remote Code Execution (RCE) via Vulnerable API (CVSS 8.8)
- CVE-2026-25887 — Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query (CVSS 7.2)
- CVE-2026-25877 — Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations (CVSS 6.5)