Chartbrew
Depomo · 8 CVEs
Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`
Apr 10, 2026
Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
Apr 10, 2026
Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API
Mar 6, 2026
Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken…
Mar 6, 2026
Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)
Mar 6, 2026
Chartbrew: Remote Code Execution (RCE) via Vulnerable API
Mar 6, 2026
Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query
Mar 6, 2026
Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations
Mar 6, 2026
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-32252 | Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` | HIGH | 0.40% | Apr 10, 2026 |
| CVE-2026-30232 | Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs | HIGH | 0.40% | Apr 10, 2026 |
| CVE-2026-27605 | Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API | MEDIUM | 0.32% | Mar 6, 2026 |
| CVE-2026-27603 | Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions | HIGH | 0.49% | Mar 6, 2026 |
| CVE-2026-27005 | Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) | HIGH | 0.74% | Mar 6, 2026 |
| CVE-2026-25888 | Chartbrew: Remote Code Execution (RCE) via Vulnerable API | HIGH | 0.94% | Mar 6, 2026 |
| CVE-2026-25887 | Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query | HIGH | 0.96% | Mar 6, 2026 |
| CVE-2026-25877 | Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations | MEDIUM | 0.36% | Mar 6, 2026 |
Showing 1 to 8 of 8 CVEs