CVE-2026-73678 | Critical | 10.0 | 2026-08-14 | MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to exec… |
CVE-2026-27483 | High | 8.8 | 2026-02-24 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb'… |
CVE-2026-2531 | Medium | 6.3 | 2026-02-16 | A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/secur… |
CVE-2025-68472 | High | 8.1 | 2026-01-12 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload… |
CVE-2024-45856 | Critical | 9.0 | 2024-09-12 | A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enume… |
CVE-2024-45855 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45854 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45853 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45852 | High | 8.8 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code… |
CVE-2024-45851 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45850 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45849 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45848 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on th… |
CVE-2024-45847 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on… |
CVE-2024-45846 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on th… |
CVE-2024-24759 | Critical | 9.3 | 2024-09-05 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request… |
CVE-2024-3575 | Medium | 6.1 | 2024-04-16 | Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb |
CVE-2023-50731 | Critical | 9.1 | 2023-12-22 | MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not val… |
CVE-2023-49796 | Medium | 5.3 | 2023-12-11 | MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users sh… |
CVE-2023-49795 | Medium | 6.5 | 2023-12-11 | MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`… |
CVE-2023-38699 | Critical | 9.1 | 2023-08-04 | MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False`… |
CVE-2023-30620 | High | 7.5 | 2023-04-21 | mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extra… |
CVE-2022-23522 | High | 8.5 | 2023-03-30 | MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack_archive()` from a remotely retrieved tarball… |