Chartbrew vulnerabilities

Products

• Chartbrew 19

Newest

• chartbrew Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution CVE-2026-65980 7.9 HighSeptember 21, 2026
• chartbrew Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool CVE-2026-61851 6.5 MediumSeptember 21, 2026
• chartbrew Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool CVE-2026-61852 5.8 MediumSeptember 21, 2026
• chartbrew Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation CVE-2026-61743 6.3 MediumSeptember 21, 2026
• chartbrew Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) CVE-2026-41518 7.6 HighJune 4, 2026
• chartbrew Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override CVE-2026-40603 6.5 MediumApril 30, 2026
• chartbrew Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle CVE-2026-40601 7.5 HighApril 30, 2026
• chartbrew Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id CVE-2026-40600 8.1 HighApril 30, 2026
• chartbrew Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks CVE-2026-40595 7.5 HighApril 30, 2026
• chartbrew Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew CVE-2026-35514 6.5 MediumApril 30, 2026
• chartbrew Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks CVE-2026-40904 8.1 HighApril 30, 2026
• chartbrew Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` CVE-2026-32252 7.7 HighApril 10, 2026
• chartbrew Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs CVE-2026-30232 7.8 HighApril 10, 2026
• chartbrew Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API CVE-2026-27605 6.3 MediumMarch 6, 2026
• chartbrew Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions CVE-2026-27603 8.7 HighMarch 6, 2026
• chartbrew Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) CVE-2026-27005 8.8 HighMarch 6, 2026
• chartbrew Chartbrew: Remote Code Execution (RCE) via Vulnerable API CVE-2026-25888 8.8 HighMarch 6, 2026
• chartbrew Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query CVE-2026-25887 7.2 HighMarch 6, 2026
• chartbrew Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations CVE-2026-25877 6.5 MediumMarch 6, 2026