gcdRadar
products/chromadb

ChromaDB

Records
6
Disclosed CVEs
6
Exploited (sev 3–4)
0
CISA KEV flagged
0

Newest record 2026-06-12 · 6 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)

Exploited or KEV-listed · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for ChromaDB has confirmed exploitation or a KEV flag.

Disclosures by month · last 24 months

Dec ’246 disclosed · peak 5 in Jun ’26Nov ’26

Disclosed CVEs, no confirmed exploitation · 6

  1. closed8.8
    ChromaDB CVE-2026-45832: Authorization control bypass in ChromaDB Python project endpoints

    Disclosed · since 12 Jun 2026 · CVE-2026-45832

    AI
  2. closed8.8
    ChromaDB CVE-2026-8828: Authorization validation flaw in ChromaDB Rust project

    Disclosed · since 12 Jun 2026 · CVE-2026-8828

    AI
  3. closed8.8
    ChromaDB CVE-2026-45830: ChromaDB cross-tenant access vulnerability

    Disclosed · since 12 Jun 2026 · CVE-2026-45830

    AI
  4. closed8.8
    ChromaDB CVE-2026-45831: ChromaDB authorization provider flaw

    Disclosed · since 12 Jun 2026 · CVE-2026-45831

    AI
  5. closed9.4
    ChromaDB CVE-2026-45833: ChromaDB code injection vulnerability

    Disclosed · since 12 Jun 2026 · CVE-2026-45833

    AI
  6. closed10.0
    ChromaDB ChromaDB Python Project Contains Pre-Authentication Code Injection Vulnerability

    Disclosed · since 18 May 2026 · CVE-2026-45829

    AI

Fix status and fixed versions are recorded when a source states them (each record’s page shows what is known); check the vendor’s own advisory before acting.