Login Request a demo
CH
Product
chartbrew
by chartbrew · last CVE Sep 21, 2026
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 2High 10Medium 7Low 0
Severity
All severities19Critical2High10Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add chartbrew to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-25888
8.8
1%
Mar 6
Chartbrew: Remote Code Execution (RCE) via Vulnerable API
Affected: < 4.8.1
CVE-2026-40600
8.1
0%
Apr 30
Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id
Affected: = 4.9.0
CVE-2026-40904
8.1
0%
Apr 30
Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks
Affected: = 4.9.0
CVE-2026-65980
7.9
0%
Sep 21
Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution
Affected: < 5.2.2
CVE-2026-32252
7.7
0%
Apr 10
Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`
Affected: < 4.9.0
CVE-2026-41518
7.6
0%
Jun 4
Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)
Affected: >= 4.9.0, < 5.0.1
CVE-2026-40601
7.5
0%
Apr 30
Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle
Affected: = 4.9.0
CVE-2026-40595
7.5
0%
Apr 30
Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks
Affected: = 4.9.0
CVE-2026-27603
7.5
0%
Mar 6
Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions
Affected: < 4.8.4
CVE-2026-25887
7.2
1%
Mar 6
Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query
Affected: < 4.8.1
Showing 10