chartbrew vulnerabilities

Newest CVEs

• CVE-2026-69128

  Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap)

  chartbrew · chartbrew

  Medium4.6
• CVE-2026-68935

  Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections

  chartbrew · chartbrew

  Critical9.1
• CVE-2026-68933

  Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage

  chartbrew · chartbrew

  High7.5
• CVE-2026-86005

  Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew

  chartbrew · chartbrew

  Critical9.3
• CVE-2026-85736

  Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths

  chartbrew · chartbrew

  High8.1
• CVE-2026-85726

  Chartbrew: Blind NoSQL injection via date variable in embedded chart

  chartbrew · chartbrew

  High7.5
• CVE-2026-85712

  Chartbrew: Cross-tenant project takeover via body.team_id in /project routes

  chartbrew · chartbrew

  High8.8
• CVE-2026-85708

  Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens

  chartbrew · chartbrew

  High7.5
• CVE-2026-85295

  Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET

  chartbrew · chartbrew

  Critical9.8
• CVE-2026-54349

  Chartbrew SQL injection in dashboard filter substitution

  chartbrew · chartbrew

  Critical9.8