CVE-2026-51992

CVE-2026-51992 Within ClickHouse, a feature exists that allows a user with the correct permissions to create dictionaries in order to interact with different databases and run specific queries on them. For PostgreSQL, SELECT queries are wrapped in a COPY QUERY TO STDOUT statement before being...

CVE-2026-114081

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114081

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

EUVD-2026-106884

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

PT-2026-120207

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-19854

A flaw was found in the Grafana ClickHouse plugin. When using the Native protocol with PDC or secure SOCKS, the connection library fails to enforce Transport Layer Security TLS, causing sensitive data such as usernames, passwords, queries, and results to be transmitted in cleartext. This allows a...

CVE-2026-111670

ClickVisual versions through 1.1.2 are vulnerable to a missing authorization (CWE-862) flaw within the /api/v2/reports handlers. This security weakness allows authenticated users with low privileges to access ClickHouse instances they are not authorized to view. By iterating the instance-id param...

EUVD-2026-102961

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

PT-2026-116069

🚨 CVE-2026-111670 ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: cortex-fips, rancher-agent, elastic-agent, terraform-provider-databricks, mongodb-kubernetes-operator, crossplane-provider-aws-cloudsearch-fips, rollouts-plugin-trafficrouter-gatewayapi, crossplane-provider-azure-powerbidedicated, external-dns-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: cortex-fips, kubernetes-csi-livenessprobe, rancher-agent, elastic-agent, terraform-provider-databricks, mongodb-kubernetes-operator, crossplane-provider-aws-cloudsearch-fips, rollouts-plugin-trafficrouter-gatewayapi, crossplane-provider-azure-powerbidedicated,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: cortex-fips, kubernetes-csi-livenessprobe, rancher-agent, elastic-agent, terraform-provider-databricks, mongodb-kubernetes-operator, crossplane-provider-aws-cloudsearch-fips, rollouts-plugin-trafficrouter-gatewayapi, crossplane-provider-azure-powerbidedicated,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: cortex-fips, kubernetes-csi-livenessprobe, rancher-agent, elastic-agent, terraform-provider-databricks, mongodb-kubernetes-operator, crossplane-provider-aws-cloudsearch-fips, rollouts-plugin-trafficrouter-gatewayapi, crossplane-provider-azure-powerbidedicated,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: actions-runner-controller, helm-set-status, conftest, flux-helm-controller, traefik, step-kms-plugin, redis-operator, contour, pinact, falcoctl, kubernetes-dashboard-api, falcosidekick, thanos-operator, azcopy, rke2-cloud-provider, cloud-provider-azure,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: http-echo, actions-runner-controller, helm-set-status, conftest, flux-helm-controller, kubernetes-csi-node-driver-registrar, etcd, traefik, step-kms-plugin, redis-operator, contour, falcoctl, envoy-ratelimit, sftpgo-plugin-eventstore, kubernetes-dashboard-api,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: http-echo, actions-runner-controller, helm-set-status, conftest, flux-helm-controller, kubernetes-csi-node-driver-registrar, etcd, traefik, step-kms-plugin, redis-operator, contour, pinact, falcoctl, rqlite, envoy-ratelimit, sftpgo-plugin-eventstore,...

CVE-2026-78663 vulnerabilities

Vulnerabilities for packages: http-echo, actions-runner-controller, helm-set-status, conftest, flux-helm-controller, kubernetes-csi-node-driver-registrar, etcd, traefik, step-kms-plugin, redis-operator, contour, falcoctl, envoy-ratelimit, sftpgo-plugin-eventstore, kubernetes-dashboard-api,...