Login Request a demo
DA
Product
dataease
by dataease · last CVE Oct 14, 2026
103
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Vulnerabilities103In the news0Timeline
Severity mix
Critical 35High 46Medium 21Low 1
Severity
All severities103Critical35High46Medium21Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add dataease to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40901
8.8
1%
Apr 16
DataEase: Quartz Deserialization → Remote Code Execution
Affected: < 2.10.21
CVE-2026-40900
8.8
0%
Apr 16
DataEase has SQL Injection via Stacked Queries
Affected: < 2.10.21
CVE-2026-33207
8.8
0%
Apr 16
DataEase SQL Injection Vulnerability
Affected: < 2.10.21
CVE-2026-33121
8.8
0%
Apr 16
DataEase has SQL Injection via Datasource Save Flow
Affected: < 2.10.21
CVE-2026-33084
8.8
0%
Apr 16
DataEase has SQL Injection through its getFieldEnumObj Endpoint
Affected: < 2.10.21
CVE-2026-33083
8.8
0%
Apr 16
DataEase has SQL Injection in Order By Clause
Affected: < 2.10.21
CVE-2026-32140
8.8
1%
Mar 12
Dataease: Redshift JDBC RCE Bypass
Affected: < 2.10.20
CVE-2026-32137
8.8
0%
Mar 12
DataEase SQL Injection Vulnerability
Affected: < 2.10.20
CVE-2025-62420
8.8
1%
Oct 17
DataEase vulnerable to remote code execution via H2 JDBC driver bypass
Affected: < 2.10.14
CVE-2025-62422
8.8
1%
Oct 17
DataEase SQL injection vulnerability
Affected: < 2.10.14
CVE-2025-48999
8.8
10%
Jun 3
Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability
Affected: < 2.10.10
CVE-2025-48998
8.8
0%
Jun 3
Dataease MYSQL JDBC File Reading Vulnerability
Affected: < 2.10.10
CVE-2024-55952
8.8
1%
Dec 18
Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability
Affected: < 1.18.27
CVE-2023-28637
8.8
1%
Mar 28
DataEase is an open source data visualization analysis tool
Affected: before 1.18.5
CVE-2022-34114
8.8
1%
Jul 22
Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId
Affected: 1.11.1
CVE-2022-23331
8.8
1%
Feb 8
In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password
Affected: 1.6.1
CVE-2026-104143
8.7
0%
Oct 14
DataEase: Stored SQL Injection via dateFormat field templates
Affected: < 2.10.26
CVE-2026-104142
8.7
0%
Oct 14
DataEase: Stored SQL Injection in group-field binning bounds
Affected: < 2.10.26
CVE-2026-104141
8.7
0%
Oct 14
DataEase: SQL Injection in datasource metadata identifiers
Affected: < 2.10.26
CVE-2026-45532
8.7
1%
Aug 18
DataEase has a Path Traversal Vulnerability
Affected: < 2.10.23
CVE-2026-45320
8.7
0%
Jul 15
DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
Affected: < 2.10.23
CVE-2026-45535
8.7
0%
Jul 15
DataEase: Stored SQL Injection Vulnerability
Affected: < 2.10.23
CVE-2026-45417
8.7
0%
Jul 15
DataEase: SQL injection vulnerability
Affected: < 2.10.23
CVE-2026-50529
8.7
0%
Jul 7
DataEase: Link Token Leakage Prior to Share Password/Ticket Validation
Affected: < 2.10.24
CVE-2026-55635
8.7
0%
Jul 7
DataEase: Authenticated SQL Injection in Chart Quota Filters
Affected: < 2.10.24
CVE-2026-53751
8.7
1%
Jul 7
DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)
Affected: < 2.10.24
CVE-2026-53730
8.7
0%
Jul 7
DataEase: Unauthorized Access to Engine Database via previewSql Endpoint
Affected: < 2.10.24
CVE-2026-55633
8.7
1%
Jul 7
DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass
Affected: < 2.10.24
CVE-2026-53729
8.7
1%
Jul 7
DataEase ExportCenter IDOR allows cross-user export task access
Affected: < 2.10.24
CVE-2026-45419
8.5
0%
Jul 15
DataEase: Arbitrary File Write Vulnerability
Affected: < 2.10.23
CVE-2026-45533
8.3
0%
Jul 15
DataEase: Path Traversal Vulnerability
Affected: < 2.10.23
CVE-2026-57172
8.3
0%
Jul 7
DataEase: Hardcoded JWT Signing Secret in ShareLink
Affected: < 2.10.24
CVE-2026-32939
8.1
0%
Mar 20
DataEase is Vulnerable to H2 JDBC RCE Bypass
Affected: < 2.10.20
CVE-2024-55953
8.1
1%
Dec 18
Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability
Affected: < 1.18.27
CVE-2023-34463
8.1
1%
Jun 26
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends
Affected: before 1.18.8
CVE-2023-32310
8.1
1%
Jun 1
DataEase is an open source data visualization and analysis tool
Affected: before 1.18.7
CVE-2025-62419
7.5
0%
Oct 17
DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration
Affected: < 2.10.14
CVE-2024-46985
7.5
1%
Sep 23
DataEase has an XXE vulnerability
Affected: < 2.10.1
CVE-2024-31441
7.5
1%
May 10
Arbitrary File Reading in DataEase
Affected: < 1.18.19
CVE-2023-40771
7.5
1%
Sep 1
SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function
Affected: 1.18.9
CVE-2021-38239
7.5
1%
Feb 15
SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10
Affected: before 1.2.0
CVE-2026-55631
7.2
0%
Jul 7
DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management
Affected: < 2.10.24
CVE-2026-8724
7.2
0%
May 17
Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection
Affected: 2.10.20
CVE-2026-50124
7.1
1%
Jul 15
DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
Affected: < 2.10.23
CVE-2026-50030
7.1
0%
Jul 15
DataEase: Arbitrary SQL execution in preview path (direct data disclosure)
Affected: < 2.10.23
CVE-2026-50530
7.1
0%
Jul 7
DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets
Affected: < 2.10.24
Showing 46