Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,220All CVEsplus 19,142 rejected
- 264Last 24 hours3,269 in the last 7 days
- 16,861Last 30 days1,541 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 18 | 8 | 0 | 0 | 30 | 30 |
| Title | ||
|---|---|---|
| CVE-2026-69128 | Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap)chartbrew · chartbrew | Medium4.6 |
| CVE-2026-68935 | Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connectionschartbrew · chartbrew | Critical9.1 |
| CVE-2026-68933 | Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storagechartbrew · chartbrew | High7.5 |
| CVE-2026-86005 | Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrewchartbrew · chartbrew | Critical9.3 |
| CVE-2026-85736 | Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH pathschartbrew · chartbrew | High8.1 |
| CVE-2026-85726 | Chartbrew: Blind NoSQL injection via date variable in embedded chartchartbrew · chartbrew | High7.5 |
| CVE-2026-85712 | Chartbrew: Cross-tenant project takeover via body.team_id in /project routeschartbrew · chartbrew | High8.8 |
| CVE-2026-85708 | Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokenschartbrew · chartbrew | High7.5 |
| CVE-2026-85295 | Chartbrew: Full account takeover via JWTs accepted under default CB_SECRETchartbrew · chartbrew | Critical9.8 |
| CVE-2026-54349 | Chartbrew SQL injection in dashboard filter substitutionchartbrew · chartbrew | Critical9.8 |
| CVE-2026-54589 | Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl)chartbrew · chartbrew | High7.0 |
| CVE-2026-65980 | Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable SubstitutionPublic exploitchartbrew · chartbrew | High7.9 |
| CVE-2026-61851 | Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Toolchartbrew · chartbrew | Medium6.5 |
| CVE-2026-61852 | Chartbrew: SQL Injection via row_limit Parameter in AI runQuery ToolPublic exploitchartbrew · chartbrew | Medium5.8 |
| CVE-2026-61743 | Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request ValidationPublic exploitchartbrew · chartbrew | Medium6.3 |
| CVE-2026-41518 | Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)Public exploitchartbrew · chartbrew | High7.6 |
| CVE-2026-40603 | Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team overridePublic exploitchartbrew · chartbrew | Medium6.5 |
| CVE-2026-40601 | Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh togglePublic exploitchartbrew · chartbrew | High7.5 |
| CVE-2026-40600 | Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_idPublic exploitchartbrew · chartbrew | High8.1 |
| CVE-2026-40595 | Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checksPublic exploitchartbrew · chartbrew | High7.5 |
| CVE-2026-35514 | Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrewchartbrew · chartbrew | Medium6.5 |
| CVE-2026-40904 | Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checksPublic exploitchartbrew · chartbrew | High8.1 |
| CVE-2026-32252 | Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`Public exploitchartbrew · chartbrew | High7.7 |
| CVE-2026-30232 | Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLschartbrew · chartbrew | High7.8 |
| CVE-2026-27605 | Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload APIchartbrew · chartbrew | Medium6.3 |
| CVE-2026-27603 | Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissionschartbrew · chartbrew | High8.7 |
| CVE-2026-27005 | Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)chartbrew · chartbrew | High8.8 |
| CVE-2026-25888 | Chartbrew: Remote Code Execution (RCE) via Vulnerable APIchartbrew · chartbrew | High8.8 |
| CVE-2026-25887 | Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Querychartbrew · chartbrew | High7.2 |
| CVE-2026-25877 | Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operationschartbrew · chartbrew | Medium6.5 |