chartbrew

Records30All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

chartbrew records in CISA KEV

No chartbrew vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Chartbrew 8 records HIGH

Records

30 records

TI-2026-46993 CVE-2026-65980

Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

HIGH 74

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.00465 Published 2026-09-21 Fixed in 5.2.2 CWE-89

TI-2026-29337 CVE-2026-40601

Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle

HIGH 72

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00326 Published 2026-04-30 No fix listed CWE-862

TI-2026-29331 CVE-2026-40595

Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks

HIGH 72

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00275 Published 2026-04-30 No fix listed CWE-284

TI-2026-29560 CVE-2026-40904

Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks

HIGH 70

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00235 Published 2026-04-30 No fix listed CWE-284

TI-2026-29336 CVE-2026-40600

Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id

HIGH 68

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00232 Published 2026-04-30 No fix listed CWE-639

TI-2026-24781 CVE-2026-32252

Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`

HIGH 67

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00296 Published 2026-04-10 Fixed in 4.9.0 CWE-285

TI-2026-30101 CVE-2026-41518

Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)

HIGH 66

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.002 Published 2026-06-04 Fixed in 5.0.1 CWE-79

TI-2026-29339 CVE-2026-40603

Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override

MEDIUM 62

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00241 Published 2026-04-30 No fix listed CWE-284

TI-2026-44259 CVE-2026-61852

Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

MEDIUM 61

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00362 Published 2026-09-21 Fixed in 5.2.2 CWE-89

TI-2026-44187 CVE-2026-61743

Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

MEDIUM 61

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00405 Published 2026-09-21 Fixed in 5.2.2 CWE-350

TI-2026-21482 CVE-2026-27005

Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)

MEDIUM 45

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00584 Published 2026-03-06 Fixed in 4.8.3 CWE-89

TI-2026-21989 CVE-2026-27603

Missing authentication in chartbrew

MEDIUM 44

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00478 Published 2026-03-06 Fixed in 4.8.4 CWE-306

TI-2026-86130 CVE-2026-85295

Default signing key lets attackers forge Chartbrew session tokens

MEDIUM 42

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00397 Published 2026-11-06 Fixed in 5.2.3 CWE-1394

TI-2026-86127 CVE-2026-54349

SQL injection in Chartbrew dashboard filter substitution

MEDIUM 42

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00426 Published 2026-11-06 Fixed in 5.2.1 CWE-89

TI-2026-20927 CVE-2026-25888

Chartbrew: Remote Code Execution (RCE) via Vulnerable API

MEDIUM 41

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00751 Published 2026-03-06 Fixed in 4.8.1 CWE-94

TI-2026-86138 CVE-2026-68935

Server-side request forgery in Chartbrew API connections

MEDIUM 40

Chartbrew is an open-source web application for creating charts from databases and APIs.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00553 Published 2026-11-06 Fixed in 5.2.3 CWE-918

TI-2026-86135 CVE-2026-86005

Missing authentication exposes BullMQ admin dashboard in Chartbrew

MEDIUM 40

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00468 Published 2026-11-06 Fixed in 5.2.3 CWE-306

TI-2026-86132 CVE-2026-85712

Cross-tenant project takeover in Chartbrew via team_id in project routes

LOW 38

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00369 Published 2026-11-06 Fixed in 5.2.3 CWE-639

TI-2026-23465 CVE-2026-30232

Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs

LOW 36

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.00252 Published 2026-04-10 Fixed in 4.8.5 CWE-918

TI-2026-86134 CVE-2026-85736

Arbitrary file deletion as root in Chartbrew via data connection paths

LOW 35

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00202 Published 2026-11-06 Fixed in 5.2.3 CWE-73

TI-2026-20926 CVE-2026-25887

Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query

LOW 35

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00925 Published 2026-03-06 Fixed in 4.8.1 CWE-94

TI-2026-27631 CVE-2026-35514

Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew

LOW 34

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00243 Published 2026-04-30 No fix listed CWE-306

TI-2026-86133 CVE-2026-85726

Blind NoSQL injection via date variable in Chartbrew embedded chart

LOW 33

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00307 Published 2026-11-06 Fixed in 5.2.3 CWE-943

TI-2026-86137 CVE-2026-68933

Chartbrew dashboard passwords guessable and stored in cleartext

LOW 32

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00191 Published 2026-11-06 Fixed in 5.2.3 CWE-307

TI-2026-86131 CVE-2026-85708

Forgeable share tokens in Chartbrew expose private chart data

LOW 32

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00193 Published 2026-11-06 Fixed in 5.2.3 CWE-347

Open these records in search →