ME
Product
metabase
On CISA KEVExploited in the wild
31
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 8High 9Medium 14Low 0
Watch
Add metabase to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86116 | 6.5 | Sep 5 | Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API Affected: 0.57.0 before 0.63.1 |
| CVE-2026-72900 | 6.5 | Aug 10 | Metabase information exposure Affected: x.58.0 before x.58.24; x.59.0 before x.59.21; x.60.0 before x.60.17; x.61.0 before x.61.11; x.62.0 before x.62.9; x.63.0 before x.63.5 |
| CVE-2026-27464 | 6.5 | Feb 21 | Metabase is an open-source data analytics platform Affected: before 0.57.13; before 1.57.13; 0.58.0 before 0.58.7; 1.58.0 before 1.58.7 |
| CVE-2025-27141 | 6.5 | Feb 24 | Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software Affected: 1.47.0 before 1.50.36; 1.51.0 before 1.51.14; 1.52.0 before 1.52.11; 1.53.0 before 1.53.2 |
| CVE-2022-43776 | 6.5 | Oct 26 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks Affected: before 0.44.5 |
| CVE-2022-39358 | 6.5 | Oct 26 | Metabase vulnerable to circumvention of Locked parameter in Signed Embedding Affected: < 0.42.6; >= 0.43.0, < 0.43.7; >= 0.44.0, < 0.44.5; >= 1.0.0, < 1.42.6; >= 1.43.0, < 1.43.7; >= 1.44.0, < 1.44.5 |
| CVE-2022-39359 | 6.5 | Oct 26 | Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs Affected: < 0.41.9; >= 0.42.0, < 0.42.6; >= 0.43.0, < 0.43.7; >= 0.44.0, < 0.44.5; >= 1.0.0, < 1.41.9; >= 1.42.0, < 1.42.6; +2 more |
| CVE-2022-39360 | 6.5 | Oct 26 | Metabase SSO users able to circumvent IdP login by doing password reset Affected: < 0.41.9; >= 0.42.0, < 0.42.6; >= 0.43.0, < 0.43.7; >= 0.44.0, < 0.44.5; >= 1.0.0, < 1.41.9; >= 1.42.0, < 1.42.6; +2 more |
| CVE-2023-23629 | 6.3 | Jan 28 | Metabase is an open source data analytics platform Affected: before 0.43.7.1; 0.44.0 before 0.44.6.1; 0.45.0 before 0.45.2.1; 1.0.0 before 1.43.7.1; 1.44.0 before 1.44.6.1; 1.45.0 before 1.45.2.1 |
| CVE-2018-0697 | 6.1 | Nov 15 | Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 0.29.3 |
| CVE-2022-24855 | 5.4 | Apr 14 | Metabase is an open source business intelligence and analytics application Affected: 0.40.0 before 0.40.8; 0.41.0 before 0.41.7; 0.42.0 before 0.42.4; 1.40.0 before 1.40.8; 1.41.0 before 1.41.7; 1.42.0 before 1.42.4 |
| CVE-2022-24853 | 5.3 | Apr 14 | Metabase is an open source business intelligence and analytics application Affected: 0.40.0 before 0.40.8; 0.41.0 before 0.41.7; 0.42.0 before 0.42.4; 1.40.0 before 1.40.8; 1.41.0 before 1.41.7; 1.42.0 before 1.42.4 |
| CVE-2026-92813 | 4.9 | Sep 16 | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass Affected: through 0.63.18 |
| CVE-2023-23628 | 4.1 | Jan 28 | Metabase is an open source data analytics platform Affected: before 0.43.7.1; 0.44.0 before 0.44.6.1; 0.45.0 before 0.45.2.1; 1.0.0 before 1.43.7.1; 1.44.0 before 1.44.6.1; 1.45.0 before 1.45.2.1 |
Showing 14