# Snowflake CVEs > Snowflake: 38 CVEs mapped to its software or packages (0 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/snowflake/cves Last updated: 2026-09-17T10:49:59Z 38 CVEs map to Snowflake (0 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Snowflake](https://rewindex.com/company/snowflake.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Snowflake’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-09-17 | [CVE-2026-92903](https://rewindex.com/cve/CVE-2026-92903.md) | Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings | 8.2 high | | | 2026-09-08 | [CVE-2026-86600](https://rewindex.com/cve/CVE-2026-86600.md) | Workload identity attestation generated before login host validation in Snowflake drivers | 8.2 high | | | 2026-09-08 | [CVE-2026-86597](https://rewindex.com/cve/CVE-2026-86597.md) | Sensitive information written to logs by Snowflake drivers | 6.5 medium | | | 2026-09-04 | [CVE-2026-85528](https://rewindex.com/cve/CVE-2026-85528.md) | Snowflake JDBC Driver auto-configuration account validation permits credential redirection | 5.3 medium | | | 2026-09-04 | [CVE-2026-85525](https://rewindex.com/cve/CVE-2026-85525.md) | Improper OCSP response validation in Snowflake drivers | 7.4 high | | | 2026-08-12 | [CVE-2026-19594](https://rewindex.com/cve/CVE-2026-19594.md) | Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation | 8.1 high | | | 2026-07-24 | [CVE-2026-16870](https://rewindex.com/cve/CVE-2026-16870.md) | Multiple Security Vulnerabilities in Snowflake libsnowflakeclient | 8.8 high | | | 2026-07-16 | [CVE-2026-15925](https://rewindex.com/cve/CVE-2026-15925.md) | Improper TLS Hostname Verification in Snowflake Connector for Python | 9.2 critical | | | 2026-07-14 | [CVE-2026-15736](https://rewindex.com/cve/CVE-2026-15736.md) | Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy | 8.3 high | | | 2026-07-14 | [CVE-2026-15183](https://rewindex.com/cve/CVE-2026-15183.md) | Input Validation Vulnerabilities in Snowflake Spark Connector | 9.2 critical | | | 2026-07-08 | [CVE-2026-15067](https://rewindex.com/cve/CVE-2026-15067.md) | Multiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account Takeover | 8.8 high | | | 2026-07-08 | [CVE-2026-15062](https://rewindex.com/cve/CVE-2026-15062.md) | SQL Injection in Snowflake Snowpark Python SDK | 9.6 critical | | | 2026-06-29 | [CVE-2026-13752](https://rewindex.com/cve/CVE-2026-13752.md) | Snowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands | 6.0 medium | | | 2026-06-29 | [CVE-2026-13751](https://rewindex.com/cve/CVE-2026-13751.md) | Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load | 4.1 medium | | | 2026-06-29 | [CVE-2026-13750](https://rewindex.com/cve/CVE-2026-13750.md) | Snowflake CLI Sensitive Credential Exposure Through Debug Logging | 5.5 medium | | | 2026-06-29 | [CVE-2026-13749](https://rewindex.com/cve/CVE-2026-13749.md) | Snowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template Injection | 8.8 high | | | 2026-06-29 | [CVE-2026-13748](https://rewindex.com/cve/CVE-2026-13748.md) | Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction | 6.3 medium | | | 2026-06-29 | [CVE-2026-13746](https://rewindex.com/cve/CVE-2026-13746.md) | Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters | 3.6 low | | | 2026-06-29 | [CVE-2026-13744](https://rewindex.com/cve/CVE-2026-13744.md) | Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input | 8.3 high | | | 2026-06-04 | [CVE-2026-10804](https://rewindex.com/cve/CVE-2026-10804.md) | Streamlit Palette hashing.py weak hash | 3.6 low | | | 2026-04-16 | [CVE-2026-6442](https://rewindex.com/cve/CVE-2026-6442.md) | Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface | 8.3 high | | | 2026-03-26 | [CVE-2026-33682](https://rewindex.com/cve/CVE-2026-33682.md) | Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure) | 4.7 medium | | | 2026-02-27 | [CVE-2026-3293](https://rewindex.com/cve/CVE-2026-3293.md) | snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos | 3.3 low | | | 2025-04-29 | [CVE-2025-46329](https://rewindex.com/cve/CVE-2025-46329.md) | Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs | 3.3 low | | | 2025-04-29 | [CVE-2025-46330](https://rewindex.com/cve/CVE-2025-46330.md) | Snowflake Connector for C/C++ retries malformed requests | 3.3 low | | | 2025-04-28 | [CVE-2025-46328](https://rewindex.com/cve/CVE-2025-46328.md) | NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file | 3.3 low | | | 2025-04-28 | [CVE-2025-46327](https://rewindex.com/cve/CVE-2025-46327.md) | Go Snowflake Driver has race condition when checking access to Easy Logging configuration file | 3.3 low | | | 2025-04-28 | [CVE-2025-46326](https://rewindex.com/cve/CVE-2025-46326.md) | Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file | 3.3 low | | | 2025-04-28 | [CVE-2025-46614](https://rewindex.com/cve/CVE-2025-46614.md) | | 3.3 low | | | 2025-03-13 | [CVE-2025-27496](https://rewindex.com/cve/CVE-2025-27496.md) | Snowflake JDBC Driver client-side encryption key in DEBUG logs | 3.3 low | | | 2025-01-29 | [CVE-2025-24795](https://rewindex.com/cve/CVE-2025-24795.md) | The Snowflake Connector for Python uses insecure cache files permissions | 4.4 medium | | | 2025-01-29 | [CVE-2025-24794](https://rewindex.com/cve/CVE-2025-24794.md) | The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache | 6.7 medium | | | 2025-01-29 | [CVE-2025-24793](https://rewindex.com/cve/CVE-2025-24793.md) | Snowflake Connector for Python has an SQL Injection in write\_pandas | 7.0 high | | | 2025-01-29 | [CVE-2025-24788](https://rewindex.com/cve/CVE-2025-24788.md) | Snowflake Connector for .NET has weak temporary files permissions | 5.0 medium | | | 2025-01-29 | [CVE-2025-24790](https://rewindex.com/cve/CVE-2025-24790.md) | Snowflake JDBC uses insecure temporary credential cache file permissions | 4.4 medium | | | 2025-01-29 | [CVE-2025-24789](https://rewindex.com/cve/CVE-2025-24789.md) | Snowflake JDBC allows an untrusted search path on Windows | 7.8 high | | | 2025-01-29 | [CVE-2025-24791](https://rewindex.com/cve/CVE-2025-24791.md) | snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions | 4.4 medium | | | 2024-10-30 | [CVE-2024-43382](https://rewindex.com/cve/CVE-2024-43382.md) | | 5.9 medium | | --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Snowflake) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 1 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 1 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 2 | 4 | 1 | 0 | 0 | | 2026-07-06 | 1 | 1 | 0 | 0 | 0 | 0 | | 2026-07-13 | 2 | 1 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-09-07 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-09-14 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/snowflake/cves · Markdown: https://rewindex.com/company/snowflake/cves.md · JSON: https://rewindex.com/api/v1/companies/snowflake/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:14:14.570Z