SU
Product
Superset
On CISA KEVExploited in the wild
70
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 58Low 0
Watch
Add Superset to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-27696 | 8.8 | May 13 | Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions Affected: before 4.1.2 |
| CVE-2023-49736 | 8.8 | Dec 19 | A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects… Affected: before 2.1.2; 3.0.0 before 3.0.2 |
| CVE-2023-40610 | 8.8 | Nov 27 | Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2 Affected: before 2.1.2 |
| CVE-2022-43719 | 8.8 | Jan 16 | Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2021-41971 | 8.8 | Oct 18 | Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends… Affected: through 1.3.0 |
| CVE-2020-13948 | 8.8 | Sep 17 | While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that… Affected: before 0.37.1 |
| CVE-2020-13952 | 8.1 | Sep 30 | In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a… Affected: before 0.37.2 |
Showing 7