{"items":[{"id":"CVE-2026-123859","published":"2026-11-06T16:11:51.526Z","updated":"2026-11-06T16:45:01.480Z","title":"SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)","severity":"HIGH","score":8.1,"vendor":"Snowflake","product":"Snowflake Connector for Python","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-121925","published":"2026-11-04T11:28:56.733Z","updated":"2026-11-04T20:00:57.987Z","title":"Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver","severity":"MEDIUM","score":6.6,"vendor":"Snowflake","product":"Snowflake PHP PDO Driver","kev":false,"epss":0.00598,"kevAdded":null},{"id":"CVE-2026-114456","published":"2026-11-04T11:22:52.845Z","updated":"2026-11-04T20:00:58.177Z","title":"Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers","severity":"MEDIUM","score":6.5,"vendor":"Snowflake","product":"Snowflake Connector for Python","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-92903","published":"2026-09-17T10:49:59.907Z","updated":"2026-09-17T12:08:06.777Z","title":"Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings","severity":"HIGH","score":8.2,"vendor":"Snowflake","product":"Snowflake CLI","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-86600","published":"2026-09-08T15:48:45.858Z","updated":"2026-09-10T15:23:04.821Z","title":"Workload identity attestation generated before login host validation in Snowflake drivers","severity":"HIGH","score":8.2,"vendor":"Snowflake","product":"Snowflake Connector for Python","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-86597","published":"2026-09-08T08:24:15.020Z","updated":"2026-09-10T15:37:52.230Z","title":"Sensitive information written to logs by Snowflake drivers","severity":"MEDIUM","score":6.5,"vendor":"Snowflake","product":"Snowflake Connector for Python","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-85528","published":"2026-09-04T08:36:28.553Z","updated":"2026-09-10T15:49:41.523Z","title":"Snowflake JDBC Driver auto-configuration account validation permits credential redirection","severity":"MEDIUM","score":5.3,"vendor":"Snowflake","product":"Snowflake JDBC Driver","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-85525","published":"2026-09-04T08:22:43.369Z","updated":"2026-09-10T15:44:00.239Z","title":"Improper OCSP response validation in Snowflake drivers","severity":"HIGH","score":7.4,"vendor":"Snowflake","product":"Snowflake Connector for Python","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-19594","published":"2026-08-12T05:22:07.386Z","updated":"2026-08-12T12:33:57.987Z","title":"Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation","severity":"HIGH","score":8.1,"vendor":"Snowflake","product":"Snowflake Python APIs","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2026-16870","published":"2026-07-24T04:40:41.019Z","updated":"2026-07-24T17:23:49.204Z","title":"Multiple Security Vulnerabilities in Snowflake libsnowflakeclient","severity":"HIGH","score":8.8,"vendor":"Snowflake","product":"Snowflake libsnowflakeclient","kev":false,"epss":0.01286,"kevAdded":null},{"id":"CVE-2026-15925","published":"2026-07-16T05:31:35.515Z","updated":"2026-07-16T12:43:16.112Z","title":"Improper TLS Hostname Verification in Snowflake Connector for Python","severity":"CRITICAL","score":9.2,"vendor":"Snowflake","product":"Snowflake Connector for Python","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-15736","published":"2026-07-14T14:11:31.279Z","updated":"2026-07-14T15:14:26.264Z","title":"Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy","severity":"HIGH","score":8.3,"vendor":"Snowflake","product":"Snowflake SQLAlchemy","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-15183","published":"2026-07-14T08:42:38.507Z","updated":"2026-07-14T12:21:40.309Z","title":"Input Validation Vulnerabilities in Snowflake Spark Connector","severity":"CRITICAL","score":9.2,"vendor":"Snowflake","product":"Snowflake Spark Connector","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-15067","published":"2026-07-08T14:43:32.006Z","updated":"2026-07-08T15:19:35.970Z","title":"Multiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account Takeover","severity":"HIGH","score":8.8,"vendor":"Snowflake","product":"Terraform Provider for Snowflake","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2026-15062","published":"2026-07-08T14:32:12.165Z","updated":"2026-07-08T15:18:02.740Z","title":"SQL Injection in Snowflake Snowpark Python SDK","severity":"CRITICAL","score":9.6,"vendor":"Snowflake","product":"Snowpark Python SDK","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2026-13752","published":"2026-06-29T16:24:03.617Z","updated":"2026-06-29T17:23:42.265Z","title":"Snowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands","severity":"MEDIUM","score":6,"vendor":"Snowflake","product":"Snowflake CLI","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-13751","published":"2026-06-29T16:12:51.882Z","updated":"2026-06-29T17:23:12.223Z","title":"Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load","severity":"MEDIUM","score":4.1,"vendor":"Snowflake","product":"Snowflake CLI","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-13750","published":"2026-06-29T16:07:50.083Z","updated":"2026-06-29T16:17:31.579Z","title":"Snowflake CLI Sensitive Credential Exposure Through Debug Logging","severity":"MEDIUM","score":5.5,"vendor":"Snowflake","product":"Snowflake CLI","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-13749","published":"2026-06-29T16:02:47.000Z","updated":"2026-06-29T16:19:21.911Z","title":"Snowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template Injection","severity":"HIGH","score":8.8,"vendor":"Snowflake","product":"Snowflake CLI","kev":false,"epss":0.00538,"kevAdded":null},{"id":"CVE-2026-13748","published":"2026-06-29T15:58:00.158Z","updated":"2026-06-29T16:20:54.942Z","title":"Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction","severity":"MEDIUM","score":6.3,"vendor":"Snowflake","product":"Snowflake CLI","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-13746","published":"2026-06-29T15:51:57.399Z","updated":"2026-06-29T16:21:58.031Z","title":"Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters","severity":"LOW","score":3.6,"vendor":"Snowflake","product":"Snowflake CLI","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-13744","published":"2026-06-29T15:40:47.721Z","updated":"2026-06-29T16:23:42.013Z","title":"Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input","severity":"HIGH","score":8.3,"vendor":"Snowflake","product":"Snowflake CLI","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-6442","published":"2026-04-16T18:43:21.181Z","updated":"2026-04-16T18:54:58.366Z","title":"Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface","severity":"HIGH","score":8.3,"vendor":"Snowflake","product":"Cortex Code CLI","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2025-46614","published":"2025-04-28T00:00:00.000Z","updated":"2025-04-28T15:56:23.048Z","title":"In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information…","severity":"LOW","score":3.3,"vendor":"Snowflake","product":"Snowflake ODBC","kev":false,"epss":0.00158,"kevAdded":null}]}