Snowflake CVEs
38 vulnerabilities mapped to Snowflake’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-86597 Sensitive information written to logs by Snowflake drivers
CVSS 6.5 mediumEPSS 0.09%
CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection
CVSS 5.3 mediumEPSS 0.29%
CVE-2026-85525 Improper OCSP response validation in Snowflake drivers
CVSS 7.4 highEPSS 0.16%
CVE-2026-16870 Multiple Security Vulnerabilities in Snowflake libsnowflakeclient
CVSS 8.8 highEPSS 1.3%
CVE-2026-15925 Improper TLS Hostname Verification in Snowflake Connector for Python
CVSS 9.2 criticalEPSS 0.18%
CVE-2026-15183 Input Validation Vulnerabilities in Snowflake Spark Connector
CVSS 9.2 criticalEPSS 0.31%
CVE-2026-15062 SQL Injection in Snowflake Snowpark Python SDK
CVSS 9.6 criticalEPSS 0.39%
CVE-2026-13751 Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load
CVSS 4.1 mediumEPSS 0.20%
CVE-2026-13750 Snowflake CLI Sensitive Credential Exposure Through Debug Logging
CVSS 5.5 mediumEPSS 0.15%
CVE-2026-10804 Streamlit Palette hashing.py weak hash
CVSS 3.6 lowEPSS 0.08%
CVE-2026-6442 Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface
CVSS 8.3 highEPSS 0.36%
CVE-2026-33682 Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)
CVSS 4.7 mediumEPSS 0.30%
CVE-2025-46329 Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs
CVSS 3.3 lowEPSS 0.12%
CVE-2025-46330 Snowflake Connector for C/C++ retries malformed requests
CVSS 3.3 lowEPSS 0.17%
CVSS 3.3 lowEPSS 0.16%
CVE-2025-27496 Snowflake JDBC Driver client-side encryption key in DEBUG logs
CVSS 3.3 lowEPSS 0.12%
CVE-2025-24795 The Snowflake Connector for Python uses insecure cache files permissions
CVSS 4.4 mediumEPSS 0.14%
CVE-2025-24793 Snowflake Connector for Python has an SQL Injection in write_pandas
CVSS 7.0 highEPSS 0.31%
CVE-2025-24788 Snowflake Connector for .NET has weak temporary files permissions
CVSS 5.0 mediumEPSS 0.14%
CVE-2025-24790 Snowflake JDBC uses insecure temporary credential cache file permissions
CVSS 4.4 mediumEPSS 0.19%
CVE-2025-24789 Snowflake JDBC allows an untrusted search path on Windows
CVSS 7.8 highEPSS 0.26%
CVSS 5.9 mediumEPSS 0.18%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)