Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-69128 | Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL... | * | 4.6 | — | 2026-11-07 | |
| CVE-2026-68935 | Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections | * | 9.1 | — | 2026-11-07 | |
| CVE-2026-68933 | Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintex... | * | 7.5 | — | 2026-11-07 | |
| CVE-2026-86005 | Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew | * | 9.3 | — | 2026-11-07 | |
| CVE-2026-85736 | Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths | * | 8.1 | — | 2026-11-07 | |
| CVE-2026-85726 | Chartbrew: Blind NoSQL injection via date variable in embedded chart | * | 7.5 | — | 2026-11-07 | |
| CVE-2026-85712 | Chartbrew: Cross-tenant project takeover via body.team_id in /project routes | * | 8.8 | — | 2026-11-07 | |
| CVE-2026-85708 | Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens | * | 7.5 | — | 2026-11-07 | |
| CVE-2026-85295 | Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET | * | 9.8 | — | 2026-11-07 | |
| CVE-2026-54349 | Chartbrew SQL injection in dashboard filter substitution | * | 9.8 | — | 2026-11-07 | |
| CVE-2026-54589 | Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOu... | * | 7.0 | — | 2026-11-07 | |
| CVE-2026-65980 | Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution | * | 7.9 | — | 2026-09-22 | |
| CVE-2026-61851 | Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool | * | 6.5 | — | 2026-09-22 | |
| CVE-2026-61852 | Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool | * | 5.8 | — | 2026-09-22 | |
| CVE-2026-61743 | Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation | * | 6.3 | — | 2026-09-22 | |
| CVE-2026-41518 | Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) | * | 7.6 | — | 2026-06-05 | |
| CVE-2026-40603 | Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override | * | 6.5 | — | 2026-05-01 | |
| CVE-2026-40601 | Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle | * | 7.5 | — | 2026-05-01 | |
| CVE-2026-40600 | Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id | * | 8.1 | — | 2026-05-01 | |
| CVE-2026-40595 | Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy che... | * | 7.5 | — | 2026-05-01 | |
| CVE-2026-35514 | Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew | * | 6.5 | — | 2026-05-01 | |
| CVE-2026-40904 | Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks | * | 8.1 | — | 2026-05-01 | |
| CVE-2026-32252 | Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project... | * | 7.7 | — | 2026-04-11 | |
| CVE-2026-30232 | Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs | * | 7.8 | — | 2026-04-11 | |
| CVE-2026-27605 | Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API | * | 6.3 | — | 2026-03-06 | |
| CVE-2026-27603 | Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing ver... | * | 8.7 | — | 2026-03-06 | |
| CVE-2026-27005 | Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) | * | 8.8 | — | 2026-03-06 | |
| CVE-2026-25888 | Chartbrew: Remote Code Execution (RCE) via Vulnerable API | * | 8.8 | — | 2026-03-06 | |
| CVE-2026-25887 | Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query | * | 7.2 | — | 2026-03-06 | |
| CVE-2026-25877 | Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations | * | 6.5 | — | 2026-03-06 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).