SU
Product
Superset
On CISA KEVExploited in the wild
70
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 58Low 0
Watch
Add Superset to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-32609 | 5.4 | Oct 18 | Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page Affected: through 1.1 |
| CVE-2021-27907 | 5.4 | Mar 5 | Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information Affected: through 0.38.0 |
| CVE-2024-53948 | 5.3 | Dec 9 | Generation of Error Message Containing analytics metadata Information in Apache Superset Affected: before 4.1.0 |
| CVE-2024-34693 | 5.3 | Jun 20 | Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled Affected: before 3.1.3; 4.0.0 before 4.0.1 |
| CVE-2022-45438 | 5.3 | Jan 16 | When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a… Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2019-12414 | 5.3 | Dec 16 | In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab Affected: before 0.32 |
| CVE-2019-12413 | 5.3 | Dec 16 | In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query Affected: before 0.31 |
| CVE-2026-23981 | 4.3 | Jul 30 | Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification Affected: before 6.0.0 |
| CVE-2025-55673 | 4.3 | Aug 14 | When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload Affected: before 4.1.3 |
| CVE-2024-28148 | 4.3 | May 7 | An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache… Affected: before 4.0.0 |
| CVE-2024-24772 | 4.3 | Feb 28 | A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects… Affected: before 3.0.4; 3.1.0 before 3.1.1 |
| CVE-2024-27315 | 4.3 | Feb 28 | An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database Affected: before 3.0.4; 3.1.0 before 3.1.1 |
| CVE-2023-42505 | 4.3 | Nov 28 | An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username Affected: before 3.0.0 |
| CVE-2023-42501 | 4.3 | Nov 27 | Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations Affected: before 2.1.1 |
| CVE-2023-32672 | 4.3 | Sep 6 | An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0 Affected: through 2.1.0 |
| CVE-2023-39264 | 4.3 | Sep 6 | By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset… Affected: through 2.1.0 |
| CVE-2023-27526 | 4.3 | Sep 6 | A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0 Affected: through 2.1.0 |
| CVE-2023-27523 | 4.3 | Sep 6 | Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they… Affected: through 2.1.0 |
| CVE-2023-27525 | 4.3 | Apr 17 | An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1 Affected: through 2.0.1 |
| CVE-2021-37839 | 4.3 | Jul 6 | Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on Affected: through 1.5.1 |