Vulnerabilities

TI-2026-86139 CVE-2026-69128

Blocklist bypass in Chartbrew AI SQL tool allows arbitrary file read

LOW 21

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0MEDIUM 4.6 Network High privileges No interaction EPSS 0.00356 Published 2026-11-06 Fixed in 5.2.3 CWE-184

TI-2026-86138 CVE-2026-68935

Server-side request forgery in Chartbrew API connections

MEDIUM 40

Chartbrew is an open-source web application for creating charts from databases and APIs.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00553 Published 2026-11-06 Fixed in 5.2.3 CWE-918

TI-2026-86137 CVE-2026-68933

Chartbrew dashboard passwords guessable and stored in cleartext

LOW 32

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00191 Published 2026-11-06 Fixed in 5.2.3 CWE-307

TI-2026-86135 CVE-2026-86005

Missing authentication exposes BullMQ admin dashboard in Chartbrew

MEDIUM 40

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00468 Published 2026-11-06 Fixed in 5.2.3 CWE-306

TI-2026-86134 CVE-2026-85736

Arbitrary file deletion as root in Chartbrew via data connection paths

LOW 35

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00202 Published 2026-11-06 Fixed in 5.2.3 CWE-73

TI-2026-86133 CVE-2026-85726

Blind NoSQL injection via date variable in Chartbrew embedded chart

LOW 33

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00307 Published 2026-11-06 Fixed in 5.2.3 CWE-943

TI-2026-86132 CVE-2026-85712

Cross-tenant project takeover in Chartbrew via team_id in project routes

LOW 38

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00369 Published 2026-11-06 Fixed in 5.2.3 CWE-639

TI-2026-86131 CVE-2026-85708

Forgeable share tokens in Chartbrew expose private chart data

LOW 32

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00193 Published 2026-11-06 Fixed in 5.2.3 CWE-347

TI-2026-86130 CVE-2026-85295

Default signing key lets attackers forge Chartbrew session tokens

MEDIUM 42

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00397 Published 2026-11-06 Fixed in 5.2.3 CWE-1394

TI-2026-86127 CVE-2026-54349

SQL injection in Chartbrew dashboard filter substitution

MEDIUM 42

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00426 Published 2026-11-06 Fixed in 5.2.1 CWE-89

TI-2026-86128 CVE-2026-54589

Server-side request forgery bypass in Chartbrew API data connections

LOW 31

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00344 Published 2026-11-06 Fixed in 5.2.1 CWE-918

TI-2026-46993 CVE-2026-65980

Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

HIGH 74

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.00465 Published 2026-09-21 Fixed in 5.2.2 CWE-89

TI-2026-44258 CVE-2026-61851

Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

LOW 29

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00471 Published 2026-09-21 Fixed in 5.2.2 CWE-184

TI-2026-44259 CVE-2026-61852

Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

MEDIUM 61

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00362 Published 2026-09-21 Fixed in 5.2.2 CWE-89

TI-2026-44187 CVE-2026-61743

Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

MEDIUM 61

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00405 Published 2026-09-21 Fixed in 5.2.2 CWE-350

TI-2026-30101 CVE-2026-41518

Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)

HIGH 66

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.002 Published 2026-06-04 Fixed in 5.0.1 CWE-79

TI-2026-29339 CVE-2026-40603

Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override

MEDIUM 62

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00241 Published 2026-04-30 No fix listed CWE-284

TI-2026-29337 CVE-2026-40601

Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle

HIGH 72

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00326 Published 2026-04-30 No fix listed CWE-862

TI-2026-29336 CVE-2026-40600

Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id

HIGH 68

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00232 Published 2026-04-30 No fix listed CWE-639

TI-2026-29331 CVE-2026-40595

Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks

HIGH 72

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00275 Published 2026-04-30 No fix listed CWE-284

TI-2026-27631 CVE-2026-35514

Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew

LOW 34

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00243 Published 2026-04-30 No fix listed CWE-306

TI-2026-29560 CVE-2026-40904

Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks

HIGH 70

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00235 Published 2026-04-30 No fix listed CWE-284

TI-2026-24781 CVE-2026-32252

Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`

HIGH 67

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00296 Published 2026-04-10 Fixed in 4.9.0 CWE-285

TI-2026-23465 CVE-2026-30232

Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs

LOW 36

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.00252 Published 2026-04-10 Fixed in 4.8.5 CWE-918

TI-2026-21991 CVE-2026-27605

Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API

LOW 28

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00251 Published 2026-03-06 Fixed in 4.8.4 CWE-434

Vulnerabilities

Filters