{"schema_version":1,"title":"Chartbrew vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in Chartbrew: 11 in the last 7 days and 13 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-69128, was published on 6 November 2026. 11 vulnerabilities in the last four weeks, up 450% on the four before (2). 3 critical against 0.","url":"https://junglewise.ai/threats/technologies/chartbrew-chartbrew","json_url":"https://junglewise.ai/threats/technologies/chartbrew-chartbrew.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/chartbrew-chartbrew","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":5,"all_time":13,"critical":3,"exploited":0,"last_7_days":11,"last_30_days":11,"last_90_days":13,"last_365_days":13},"latest":[{"cve":"CVE-2026-69128","slug":"cve-2026-69128-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew AI SQL blocklist bypass in PostgreSQL query validation","severity":"info","exploited":false,"published_at":"2026-11-06T22:17:59.57+00:00","url":"https://junglewise.ai/threats/cve-2026-69128-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-68935","cvss":9.1,"slug":"cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts","title":"Chartbrew API connection private host bypass","severity":"critical","exploited":false,"published_at":"2026-11-06T22:17:59.39+00:00","url":"https://junglewise.ai/threats/cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts"},{"cve":"CVE-2026-68933","cvss":7.5,"slug":"cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew dashboard password brute force via plaintext storage","severity":"high","exploited":false,"published_at":"2026-11-06T22:17:59.22+00:00","url":"https://junglewise.ai/threats/cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-86005","slug":"cve-2026-86005-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew BullMQ dashboard authentication bypass","severity":"info","exploited":false,"published_at":"2026-11-06T21:17:12.117+00:00","url":"https://junglewise.ai/threats/cve-2026-86005-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-85736","cvss":8.1,"slug":"cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew arbitrary file deletion via connection cleanup","severity":"high","exploited":false,"published_at":"2026-11-06T21:17:11.757+00:00","url":"https://junglewise.ai/threats/cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-85726","cvss":7.5,"slug":"cve-2026-85726-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew MongoDB query injection in date-typed variables","severity":"high","exploited":false,"published_at":"2026-11-06T21:17:11.567+00:00","url":"https://junglewise.ai/threats/cve-2026-85726-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-85712","cvss":8.8,"slug":"cve-2026-85712-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew authorization bypass via tenant boundary confusion","severity":"high","exploited":false,"published_at":"2026-11-06T21:17:11.373+00:00","url":"https://junglewise.ai/threats/cve-2026-85712-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-85708","cvss":7.5,"slug":"cve-2026-85708-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew chart share token forgery with default secret","severity":"high","exploited":false,"published_at":"2026-11-06T21:17:11.183+00:00","url":"https://junglewise.ai/threats/cve-2026-85708-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-85295","cvss":9.8,"slug":"cve-2026-85295-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew authentication bypass via legacy session tokens","severity":"critical","exploited":false,"published_at":"2026-11-06T21:17:10.89+00:00","url":"https://junglewise.ai/threats/cve-2026-85295-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-54589","slug":"cve-2026-54589-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew NAT64/DNS64 SSRF bypass in outbound policy","severity":"info","exploited":false,"published_at":"2026-11-06T21:17:09.143+00:00","url":"https://junglewise.ai/threats/cve-2026-54589-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-54349","cvss":9.8,"slug":"cve-2026-54349-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew SQL injection via dashboard variable substitution","severity":"critical","exploited":false,"published_at":"2026-11-06T21:17:08.947+00:00","url":"https://junglewise.ai/threats/cve-2026-54349-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-65980","epss":0.0066,"slug":"cve-2026-65980-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew SQL injection in ClickHouse query formatting","severity":"info","exploited":false,"published_at":"2026-09-21T22:16:58.317+00:00","url":"https://junglewise.ai/threats/cve-2026-65980-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-61852","epss":0.0036,"slug":"cve-2026-61852-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew SQL injection via unvalidated row_limit parameter","severity":"info","exploited":false,"published_at":"2026-09-21T22:16:58.163+00:00","url":"https://junglewise.ai/threats/cve-2026-61852-chartbrew-is-an-open-source-web-application-that-can-connect"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":3,"exploited":0,"vulnerabilities":11},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Chartbrew","slug":"chartbrew-chartbrew","vendor":{"hub":true,"name":"Chartbrew","slug":"chartbrew","url":"https://junglewise.ai/threats/vendors/chartbrew"},"aliases":[],"category":"web","homepage":"https://chartbrew.com","description":"Web application for creating data visualizations and dashboards from various data sources.","url":"https://junglewise.ai/threats/technologies/chartbrew-chartbrew"},"most_severe":[{"cve":"CVE-2026-85295","cvss":9.8,"slug":"cve-2026-85295-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew authentication bypass via legacy session tokens","severity":"critical","exploited":false,"published_at":"2026-11-06T21:17:10.89+00:00","url":"https://junglewise.ai/threats/cve-2026-85295-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-54349","cvss":9.8,"slug":"cve-2026-54349-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew SQL injection via dashboard variable substitution","severity":"critical","exploited":false,"published_at":"2026-11-06T21:17:08.947+00:00","url":"https://junglewise.ai/threats/cve-2026-54349-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-68935","cvss":9.1,"slug":"cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts","title":"Chartbrew API connection private host bypass","severity":"critical","exploited":false,"published_at":"2026-11-06T22:17:59.39+00:00","url":"https://junglewise.ai/threats/cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts"},{"cve":"CVE-2026-85712","cvss":8.8,"slug":"cve-2026-85712-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew authorization bypass via tenant boundary confusion","severity":"high","exploited":false,"published_at":"2026-11-06T21:17:11.373+00:00","url":"https://junglewise.ai/threats/cve-2026-85712-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-85736","cvss":8.1,"slug":"cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew arbitrary file deletion via connection cleanup","severity":"high","exploited":false,"published_at":"2026-11-06T21:17:11.757+00:00","url":"https://junglewise.ai/threats/cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-68933","cvss":7.5,"slug":"cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew dashboard password brute force via plaintext storage","severity":"high","exploited":false,"published_at":"2026-11-06T22:17:59.22+00:00","url":"https://junglewise.ai/threats/cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-85726","cvss":7.5,"slug":"cve-2026-85726-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew MongoDB query injection in date-typed variables","severity":"high","exploited":false,"published_at":"2026-11-06T21:17:11.567+00:00","url":"https://junglewise.ai/threats/cve-2026-85726-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-85708","cvss":7.5,"slug":"cve-2026-85708-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew chart share token forgery with default secret","severity":"high","exploited":false,"published_at":"2026-11-06T21:17:11.183+00:00","url":"https://junglewise.ai/threats/cve-2026-85708-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-65980","epss":0.0066,"slug":"cve-2026-65980-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew SQL injection in ClickHouse query formatting","severity":"info","exploited":false,"published_at":"2026-09-21T22:16:58.317+00:00","url":"https://junglewise.ai/threats/cve-2026-65980-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-61852","epss":0.0036,"slug":"cve-2026-61852-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew SQL injection via unvalidated row_limit parameter","severity":"info","exploited":false,"published_at":"2026-09-21T22:16:58.163+00:00","url":"https://junglewise.ai/threats/cve-2026-61852-chartbrew-is-an-open-source-web-application-that-can-connect"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}