{"items":[{"id":"CVE-2026-116366","published":"2026-10-30T11:00:11.115Z","updated":"2026-10-30T16:36:32.335Z","title":"Unauthenticated RCE vulnerability against ClickHouse Server","severity":"CRITICAL","score":9.5,"vendor":"ClickHouse","product":"ClickHouse","kev":false,"epss":0.00962,"kevAdded":null,"exploit":false},{"id":"CVE-2019-16536","published":"2025-05-21T07:13:15.603Z","updated":"2025-05-21T13:49:34.919Z","title":"Stack overflow leading to DoS can be triggered by a malicious authenticated client.","severity":"HIGH","score":8.2,"vendor":"Clickhouse","product":"DB","kev":false,"epss":0.00903,"kevAdded":null,"exploit":false},{"id":"CVE-2025-1385","published":"2025-03-20T07:13:34.577Z","updated":"2025-03-20T15:10:30.494Z","title":"Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration","severity":"HIGH","score":7.5,"vendor":"ClickHouse","product":"ClickHouse OSS","kev":false,"epss":0.00465,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6873","published":"2024-08-01T15:57:25.304Z","updated":"2024-08-02T15:18:28.271Z","title":"Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.","severity":"HIGH","score":8.1,"vendor":"ClickHouse","product":"ClickHouse","kev":false,"epss":0.00721,"kevAdded":null,"exploit":false},{"id":"CVE-2024-22412","published":"2024-03-18T20:51:40.313Z","updated":"2024-08-01T22:43:34.945Z","title":"ClickHouse's Role-based Access Control is bypassed when query caching is enabled.","severity":"LOW","score":2.4,"vendor":"ClickHouse","product":"ClickHouse","kev":false,"epss":0.00587,"kevAdded":null,"exploit":true},{"id":"CVE-2023-48704","published":"2023-12-22T15:18:12.846Z","updated":"2024-08-02T21:37:54.582Z","title":"Unauthenticated heap buffer overflow in Gorrila codec decompression","severity":"HIGH","score":7,"vendor":"ClickHouse","product":"ClickHouse","kev":false,"epss":0.00495,"kevAdded":null,"exploit":false},{"id":"CVE-2023-48298","published":"2023-12-21T23:07:43.901Z","updated":"2024-11-27T15:47:44.723Z","title":"Integer underflow leading to stack overflow in FPC codec decompression","severity":"MEDIUM","score":5.9,"vendor":"ClickHouse","product":"ClickHouse","kev":false,"epss":0.00634,"kevAdded":null,"exploit":false},{"id":"CVE-2023-47118","published":"2023-12-20T16:30:21.942Z","updated":"2024-08-02T21:01:22.658Z","title":"Heap buffer overflow in T64 codec decompression","severity":"HIGH","score":7,"vendor":"ClickHouse","product":"ClickHouse","kev":false,"epss":0.00462,"kevAdded":null,"exploit":false},{"id":"CVE-2018-14671","published":"2019-08-15T17:46:03.000Z","updated":"2024-08-05T09:38:12.939Z","title":"In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.","severity":"CRITICAL","score":9.8,"vendor":"ClickHouse","product":"ClickHouse","kev":false,"epss":0.03422,"kevAdded":null,"exploit":false},{"id":"CVE-2018-14670","published":"2019-08-15T17:13:39.000Z","updated":"2024-08-05T09:38:13.009Z","title":"Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.","severity":"CRITICAL","score":9.8,"vendor":"ClickHouse","product":"ClickHouse","kev":false,"epss":0.01793,"kevAdded":null,"exploit":false}]}