dbt-labs dbt-core

• CVE-2026-100406 High 8.2 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve` 0.4%
• CVE-2026-39382 Critical 9.3 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output 0.4%
• CVE-2024-40637 Medium 4.2 Implicit override for built-in materializations from installed packages in dbt-core 0.4%
• CVE-2024-36105 Medium 5.3 dbt allows Binding to an Unrestricted IP Address via socketsocket 0.7%