mindsdb records

22 published records for vendor mindsdb.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 72.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

22 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
42Plan	CVE-2025-68472Proof of concept	MindsDB has improper sanitation of filepath that leads to information disclosure and DOSmindsdb · mindsdb · CWE-22 Pre-auth Path traversal	Critical9.1	—	20.3%	Jan 12, 2026
38Monitor	CVE-2026-27483Proof of concept	MindsDB has Path Traversal in /api/files Leading to Remote Code Executionmindsdb · mindsdb · CWE-22 RCE Path traversal	High8.8	—	8.8%	Feb 24, 2026
37Monitor	CVE-2024-24759Proof of concept	MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebindingmindsdb · mindsdb · CWE-918 Pre-auth SSRF	Critical9.1	—	4.9%	Sep 5, 2024
36Monitor	CVE-2024-45846No exploit	An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integrationmindsdb · mindsdb · CWE-95 RCE	High8.8	—	2.1%	Sep 12, 2024
36Monitor	CVE-2023-50731No exploit	MindsDB has arbitrary file write in file.pymindsdb · mindsdb · CWE-918 Pre-auth SSRF	Critical9.1	—	1.0%	Dec 22, 2023
35Monitor	CVE-2022-23522No exploit	Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdbmindsdb · mindsdb · CWE-22 Path traversal	High8.8	—	0.9%	Mar 30, 2023
35Monitor	CVE-2024-45850No exploit	An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointmindsdb · mindsdb · CWE-95 RCE	High8.8	—	0.9%	Sep 12, 2024
35Monitor	CVE-2024-45851No exploit	An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointmindsdb · mindsdb · CWE-95 RCE	High8.8	—	0.9%	Sep 12, 2024
35Monitor	CVE-2024-45849No exploit	An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointmindsdb · mindsdb · CWE-95 RCE	High8.8	—	0.9%	Sep 12, 2024
35Monitor	CVE-2024-45847No exploit	An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integratimindsdb · mindsdb · CWE-95 RCE	High8.8	—	0.9%	Sep 12, 2024
35Monitor	CVE-2024-45848No exploit	An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integrationmindsdb · mindsdb · CWE-95 RCE	High8.8	—	0.9%	Sep 12, 2024
35Monitor	CVE-2024-45852No exploit	Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model tomindsdb · mindsdb · CWE-502 RCE Deserialization	High8.8	—	0.7%	Sep 12, 2024
30Monitor	CVE-2023-30620No exploit	Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdbmindsdb · mindsdb · CWE-22 Pre-auth Path traversal	High7.5	—	1.0%	Apr 21, 2023
30Monitor	CVE-2024-45853No exploit	Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousmindsdb · mindsdb · CWE-502 RCE Deserialization	High7.5	—	0.5%	Sep 12, 2024
30Monitor	CVE-2024-45854No exploit	Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousmindsdb · mindsdb · CWE-502 RCE Deserialization	High7.5	—	0.5%	Sep 12, 2024
30Monitor	CVE-2024-45855No exploit	Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousmindsdb · mindsdb · CWE-502 RCE Deserialization	High7.5	—	0.5%	Sep 12, 2024
26Monitor	CVE-2023-38699No exploit	MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issuemindsdb · mindsdb · CWE-311	Medium6.5	—	0.3%	Aug 4, 2023
24Monitor	CVE-2024-3575No exploit	Cross-site Scripting (XSS) - Stored in mindsdb/mindsdbmindsdb · mindsdb · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Apr 15, 2024
21Monitor	CVE-2024-45856No exploit	A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whmindsdb · mindsdb · CWE-79 XSS	Medium5.4	—	0.5%	Sep 12, 2024
21Monitor	CVE-2023-49796No exploit	MindsDB Arbitrary File Write vulnerabilitymindsdb · mindsdb · CWE-20 Pre-auth	Medium5.3	—	0.5%	Dec 11, 2023
21Monitor	CVE-2023-49795No exploit	MindsDB Server-Side Request Forgery vulnerabilitymindsdb · mindsdb · CWE-918 Pre-auth SSRF	Medium5.3	—	0.4%	Dec 11, 2023
8Monitor	CVE-2026-2531No exploit	MindsDB File Upload security.py clear_filename server-side request forgerymindsdb · mindsdb · CWE-918 SSRF	Low2.1	—	0.2%	Feb 16, 2026

CVE-2025-68472
42Plan
MindsDB has improper sanitation of filepath that leads to information disclosure and DOS
CriticalCVSS 9.1Proof of conceptEPSS 20%
- Pre-auth
- Path traversal
mindsdb · mindsdbJan 12, 2026
CVE-2026-27483
38Monitor
MindsDB has Path Traversal in /api/files Leading to Remote Code Execution
HighCVSS 8.8Proof of conceptEPSS 9%
- RCE
- Path traversal
mindsdb · mindsdbFeb 24, 2026
CVE-2024-24759
37Monitor
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
CriticalCVSS 9.1Proof of conceptEPSS 5%
- Pre-auth
- SSRF
mindsdb · mindsdbSep 5, 2024
CVE-2024-45846
36Monitor
An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration
HighCVSS 8.8No exploitEPSS 2%
- RCE
mindsdb · mindsdbSep 12, 2024
CVE-2023-50731
36Monitor
MindsDB has arbitrary file write in file.py
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- SSRF
mindsdb · mindsdbDec 22, 2023
CVE-2022-23522
35Monitor
Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdb
HighCVSS 8.8No exploitEPSS 1%
- Path traversal
mindsdb · mindsdbMar 30, 2023
CVE-2024-45850
35Monitor
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint
HighCVSS 8.8No exploitEPSS 1%
- RCE
mindsdb · mindsdbSep 12, 2024
CVE-2024-45851
35Monitor
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint
HighCVSS 8.8No exploitEPSS 1%
- RCE
mindsdb · mindsdbSep 12, 2024
CVE-2024-45849
35Monitor
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint
HighCVSS 8.8No exploitEPSS 1%
- RCE
mindsdb · mindsdbSep 12, 2024
CVE-2024-45847
35Monitor
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrati
HighCVSS 8.8No exploitEPSS 1%
- RCE
mindsdb · mindsdbSep 12, 2024
CVE-2024-45848
35Monitor
An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration
HighCVSS 8.8No exploitEPSS 1%
- RCE
mindsdb · mindsdbSep 12, 2024
CVE-2024-45852
35Monitor
Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Deserialization
mindsdb · mindsdbSep 12, 2024
CVE-2023-30620
30Monitor
Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Path traversal
mindsdb · mindsdbApr 21, 2023
CVE-2024-45853
30Monitor
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhous
HighCVSS 7.5No exploitEPSS 1%
- RCE
- Deserialization
mindsdb · mindsdbSep 12, 2024
CVE-2024-45854
30Monitor
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhous
HighCVSS 7.5No exploitEPSS 1%
- RCE
- Deserialization
mindsdb · mindsdbSep 12, 2024
CVE-2024-45855
30Monitor
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhous
HighCVSS 7.5No exploitEPSS 1%
- RCE
- Deserialization
mindsdb · mindsdbSep 12, 2024
CVE-2023-38699
26Monitor
MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue
MediumCVSS 6.5No exploitEPSS 0%
mindsdb · mindsdbAug 4, 2023
CVE-2024-3575
24Monitor
Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
mindsdb · mindsdbApr 15, 2024
CVE-2024-45856
21Monitor
A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload wh
MediumCVSS 5.4No exploitEPSS 1%
- XSS
mindsdb · mindsdbSep 12, 2024
CVE-2023-49796
21Monitor
MindsDB Arbitrary File Write vulnerability
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
mindsdb · mindsdbDec 11, 2023
CVE-2023-49795
21Monitor
MindsDB Server-Side Request Forgery vulnerability
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- SSRF
mindsdb · mindsdbDec 11, 2023
CVE-2026-2531
8Monitor
MindsDB File Upload security.py clear_filename server-side request forgery
LowCVSS 2.1No exploitEPSS 0%
- SSRF
mindsdb · mindsdbFeb 16, 2026