ME
Product
metabase
On CISA KEVExploited in the wild
31
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 8High 9Medium 14Low 0
Watch
Add metabase to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-72898 In wildKEV | 10.0 | Aug 10 | Metabase SQL injection via password reset endpoint Affected: x.58.0 before x.58.24; x.59.0 before x.59.21; x.60.0 before x.60.17; x.61.0 before x.61.11; x.62.0 before x.62.9; x.63.0 before x.63.5 |
| CVE-2026-72899 | 10.0 | Aug 10 | Metabase SQL injection via public card or dashboard Affected: x.58.0 before x.58.24; x.59.0 before x.59.21; x.60.0 before x.60.17; x.61.0 before x.61.11; x.62.0 before x.62.9; x.63.0 before x.63.5 |
| CVE-2023-37470 | 9.8 | Aug 4 | Metabase is an open-source business intelligence and analytics platform Affected: before 0.43.7.3; before 1.43.7.3; 0.44.0 before 0.44.7.3; 0.45.0 before 0.45.4.3; 0.46.0 before 0.46.6.4; 1.44.0 before 1.44.7.3; +2 more |
| CVE-2023-38646 | 9.8 | Jul 21 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level Affected: before 0.43.7.2; before 1.43.7.2; 0.44.0 before 0.44.7.1; 0.45.0 before 0.45.4.1; 0.46.0 before 0.46.6.1; 1.44.0 before 1.44.7.1; +2 more |
| CVE-2023-32680 | 9.6 | May 18 | Metabase is an open source business analytics engine Affected: before 0.44.7; 0.45.0 before 0.45.4; 0.46.0 before 0.46.3; 1.0.0 before 1.44.7; 1.45.0 before 1.45.4; 1.46.0 before 1.46.3 |
| CVE-2026-103928 | 9.3 | Oct 13 | Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions Affected: >= 1.55.0, < 1.58.16; >= 1.59.0, < 1.59.13; >= 1.60.0, < 1.60.9; >= 1.61.0, < 1.61.4; >= 0.55.0, < 0.58.15.3; >= 0.59.0, < 0.59.12.1; +2 more |
| CVE-2026-50148 | 9.1 | Jul 15 | Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write Affected: >= 1.54.0, < 1.54.24; >= 1.55.0, < 1.55.24; >= 1.56.0, < 1.56.25; >= 1.57.0, < 1.57.19; >= 1.58.0, < 1.58.14; >= 1.59.0, < 1.59.10; +1 more |
| CVE-2026-59826 | 9.1 | Jul 9 | Metabase: Arbitrary Code Execution via Database Connection Detail Bypass Affected: >= 1.55.0, < 1.58.15.1; >= 1.59.0, < 1.59.12; >= 1.60.0, < 1.60.6.3; >= 1.61.0, < 1.61.2 |
Showing 8