| CVE-2026-23985 |
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0
|
5.3
Moyenne
|
30 juil. 2026 |
| CVE-2026-23981 |
An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to…
|
5.3
Moyenne
|
30 juil. 2026 |
| CVE-2026-23969 |
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially…
|
5.3
Moyenne
|
24 févr. 2026 |
| CVE-2026-23980 |
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset…
|
5.3
Moyenne
|
24 févr. 2026 |
| CVE-2026-23982 |
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data…
|
7.1
Élevée
|
24 févr. 2026 |
| CVE-2026-23983 |
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive…
|
2.3
Faible
|
24 févr. 2026 |
| CVE-2026-23984 |
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab…
|
7.1
Élevée
|
24 févr. 2026 |
| CVE-2025-55675 |
Apache Superset contains an improper access control vulnerability in its /explore endpoint
|
5.3
Moyenne
|
14 août 2025 |
| CVE-2025-55674 |
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL…
|
5.3
Moyenne
|
14 août 2025 |
| CVE-2025-55672 |
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization
|
5.3
Moyenne
|
14 août 2025 |
| CVE-2025-55673 |
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query…
|
5.3
Moyenne
|
14 août 2025 |
| CVE-2025-48912 |
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by…
|
7.1
Élevée
|
30 mai 2025 |
| CVE-2025-27696 |
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets…
|
5.3
Moyenne
|
13 mai 2025 |
| CVE-2024-55633 |
Improper Authorization vulnerability in Apache Superset
|
7.1
Élevée
|
12 déc. 2024 |
| CVE-2024-53949 |
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default)
|
7.6
Élevée
|
9 déc. 2024 |
| CVE-2024-53948 |
Generation of Error Message Containing analytics metadata Information in Apache Superset
|
5.3
Moyenne
|
9 déc. 2024 |
| CVE-2024-53947 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset
|
2.3
Faible
|
9 déc. 2024 |
| CVE-2024-39887 |
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in…
|
4.3
Moyenne
|
16 juil. 2024 |
| CVE-2024-34693 |
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB…
|
6.8
Moyenne
|
20 juin 2024 |
| CVE-2024-28148 |
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a…
|
4.3
Moyenne
|
7 mai 2024 |
| CVE-2024-26016 |
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and…
|
4.3
Moyenne
|
28 févr. 2024 |
| CVE-2024-24779 |
Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows…
|
5.0
Moyenne
|
28 févr. 2024 |
| CVE-2024-24772 |
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak…
|
4.3
Moyenne
|
28 févr. 2024 |
| CVE-2024-24773 |
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data…
|
4.9
Moyenne
|
28 févr. 2024 |
| CVE-2024-27315 |
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially…
|
4.3
Moyenne
|
28 févr. 2024 |