Cchartbrew

Products

Exploited and recent CVEs

• CVE-2026-65980 High 7.9 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution 0.5%
• CVE-2026-61851 Medium 6.5 Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool 0.5%
• CVE-2026-61852 Medium 5.8 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool 0.4%
• CVE-2026-61743 Medium 6.3 Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation 0.4%
• CVE-2026-41518 High 7.6 Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) 0.2%
• CVE-2026-40603 Medium 6.5 Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override 0.2%
• CVE-2026-40601 High 7.5 Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle 0.3%
• CVE-2026-40600 High 8.1 Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id 0.2%
• CVE-2026-40595 High 7.5 Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks 0.3%
• CVE-2026-35514 Medium 6.5 Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew 0.2%
• CVE-2026-40904 High 8.1 Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks 0.2%
• CVE-2026-32252 High 7.7 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` 0.3%
• CVE-2026-30232 High 7.8 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs 0.2%
• CVE-2026-27605 Medium 6.3 Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API 0.3%
• CVE-2026-27603 High 8.7 Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions 0.5%
• CVE-2026-27005 High 8.8 Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) 0.6%
• CVE-2026-25888 High 8.8 Chartbrew: Remote Code Execution (RCE) via Vulnerable API 0.8%
• CVE-2026-25887 High 7.2 Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query 0.9%
• CVE-2026-25877 Medium 6.5 Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations 0.3%