MindsDB vulnerabilities

CVEs per yearBy the year they were published

1. 20236
2. 202413
3. 20265

Newest CVEs

• CVE-2026-92207

  MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability

  MindsDB · MindsDB

  High8.8
• CVE-2026-86173

  MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

  mindsdb · mindsdb

  High8.7
• CVE-2026-73678

  MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()

  MindsDB · Minds Platform

  Critical10.0
• CVE-2026-27483

  MindsDB has Path Traversal in /api/files Leading to Remote Code Execution

  mindsdb · mindsdb

  High8.8
• CVE-2025-68472

  MindsDB has improper sanitation of filepath that leads to information disclosure and DOS

  mindsdb · mindsdb

  High8.1
• CVE-2024-45856

  A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user…

  mindsdb · mindsdb

  Critical9.0
• CVE-2024-45855

  Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run…

  mindsdb · mindsdb

  High7.1
• CVE-2024-45854

  Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run…

  mindsdb · mindsdb

  High7.1
• CVE-2024-45853

  Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run…

  mindsdb · mindsdb

  High7.1
• CVE-2024-45852

  Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code…

  mindsdb · mindsdb

  High8.8