Login Request a demo
SU
Product
Superset
by Apache · last CVE Jul 30, 2026
On CISA KEVExploited in the wild
70
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities70In the news0Timeline
Severity mix
Critical 5High 7Medium 58Low 0
Severity
All severities70Critical5High7Medium58Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Superset to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-27524
In wildKEV
9.8
98%
Apr 24
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Affected: through 2.0.1
CVE-2024-53947
9.8
1%
Dec 9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset
Affected: before 4.1.0
CVE-2024-39887
9.8
4%
Jul 16
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands
Affected: before 4.0.2
CVE-2022-27479
9.8
3%
Apr 13
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests
Affected: before 1.4.2
CVE-2018-8021
9.8
53%
Nov 7
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution
Affected: before 0.23
Showing 5