https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27605.htmlhttps://patchthecve.com/cve/CVE-2026-27605.htmlWed, 17 Jun 2026 10:27:22 +0000MEDIUM 6.3: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. Thehttps://patchthecve.com/cve/CVE-2026-27603.htmlhttps://patchthecve.com/cve/CVE-2026-27603.htmlWed, 17 Jun 2026 10:27:22 +0000HIGH 7.5: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the chart filter endpoint POST /project/:project_id/chart/:chart_id/filter is missing both verifyToken and checkPermissions middleware, allowing unauhttps://patchthecve.com/cve/CVE-2026-27005.htmlhttps://patchthecve.com/cve/CVE-2026-27005.htmlWed, 17 Jun 2026 10:26:31 +0000CRITICAL 9.8: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows https://patchthecve.com/cve/CVE-2026-25888.htmlhttps://patchthecve.com/cve/CVE-2026-25888.htmlWed, 17 Jun 2026 10:25:23 +0000HIGH 8.8: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via a vulnerable API. This issue has been patched in version 4.8.1.https://patchthecve.com/cve/CVE-2026-25887.htmlhttps://patchthecve.com/cve/CVE-2026-25887.htmlWed, 17 Jun 2026 10:25:22 +0000HIGH 7.2: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via the MongoDB dataset Query. This issue has been patched in version 4.8.1.https://patchthecve.com/cve/CVE-2026-25877.htmlhttps://patchthecve.com/cve/CVE-2026-25877.htmlWed, 17 Jun 2026 10:25:21 +0000MEDIUM 6.5: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the application performs authorization checks based solely on the project_id parameter when handling chart-related operations (update, delete, etc.).