CVE-2026-65980 is a high-severity vulnerability in Chartbrew, an open-source web application for creating charts from database and API data. The issue, fixed in version 5.2.3, allows an attacker to execute arbitrary ClickHouse SQL by exploiting the ClickHouse protocol's lack of escapeBackslash option in variable binding. Public dashboards can expose this vulnerability without authentication, potentially l [truncated]
CVE-2026-41518 is a stored cross-site scripting (XSS) vulnerability affecting Chartbrew, an open-source web application used for connecting to databases and APIs to create charts. The vulnerability exists in versions 4.9.0 through 5.0.0. An authenticated user with project-editor permissions can store arbitrary HTML/JavaScript in the `ChartDatasetConfig.legend` field. This payload is persisted in the datab [truncated]
