chartbrew vulnerabilities

Newest CVEs

• CVE-2026-65980

  Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

  chartbrew · chartbrew

  High7.9
• CVE-2026-61851

  Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

  chartbrew · chartbrew

  Medium6.5
• CVE-2026-61852

  Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

  chartbrew · chartbrew

  Medium5.8
• CVE-2026-61743

  Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

  chartbrew · chartbrew

  Medium6.3
• CVE-2026-41518

  Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)

  chartbrew · chartbrew

  High7.6
• CVE-2026-40603

  Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override

  chartbrew · chartbrew

  Medium6.5
• CVE-2026-40601

  Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle

  chartbrew · chartbrew

  High7.5
• CVE-2026-40600

  Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id

  chartbrew · chartbrew

  High8.1
• CVE-2026-40595

  Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks

  chartbrew · chartbrew

  High7.5
• CVE-2026-35514

  Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew

  chartbrew · chartbrew

  Medium6.5