MMindsDB

Products

Exploited and recent CVEs

• CVE-2026-92207 High 8.8 MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability 0.7%
• CVE-2026-86173 High 7.5 MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler 0.6%
• CVE-2026-73678 Critical 10.0 MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec() 1.6%
• CVE-2026-27483 High 8.8 MindsDB has Path Traversal in /api/files Leading to Remote Code Execution 11.0%
• CVE-2025-68472 High 8.1 MindsDB has improper sanitation of filepath that leads to information disclosure and DOS 20.3%
• CVE-2024-45856 Critical 9.0 A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or 0.5%
• CVE-2024-45855 High 7.1 Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘fin 0.5%
• CVE-2024-45854 High 7.1 Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describ 0.5%
• CVE-2024-45853 High 7.1 Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a 0.5%
• CVE-2024-45852 High 8.8 Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with. 0.7%
• CVE-2024-45851 High 8.8 An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat 0.9%
• CVE-2024-45850 High 8.8 An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat 0.9%
• CVE-2024-45849 High 8.8 An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat 0.9%
• CVE-2024-45848 High 8.8 An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ 0.8%
• CVE-2024-45847 High 8.8 An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDA 0.9%
• CVE-2024-45846 High 8.8 An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT 2.1%
• CVE-2024-24759 Critical 9.3 MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding 4.9%
• CVE-2024-3575 Medium 5.8 Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb 0.4%
• CVE-2023-50731 Critical 9.1 MindsDB has arbitrary file write in file.py 1.0%
• CVE-2023-49796 Medium 5.3 MindsDB Arbitrary File Write vulnerability 0.5%
• CVE-2023-49795 Medium 6.5 MindsDB Server-Side Request Forgery vulnerability 0.4%
• CVE-2023-38699 Critical 9.1 MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue 0.3%
• CVE-2023-30620 High 7.5 Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb 1.0%
• CVE-2022-23522 High 8.5 Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdb 0.9%