Login Request a demo
ME
Vendor
metabase
1 product with CVEs on record
31
CVEs
2
On KEV
1
New 30D
Products
ME
metabase
metabase
10.0
31 CVEs2 on KEV1 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-103928
ME
metabase
metabase
9.3
0%
Oct 13Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
CVE-2026-92813
ME
Metabase
metabase
4.9
0%
Sep 16Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
CVE-2026-86116
ME
metabase
metabase
6.5
0%
Sep 5Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
CVE-2026-72900
ME
Metabase
Metabase
6.5
0%
Aug 10Metabase information exposure
CVE-2026-72899
ME
Metabase
Metabase
10.0
1%
Aug 10Metabase SQL injection via public card or dashboard
CVE-2026-72898
In wildKEV
ME
Metabase
Metabase
10.0
99%
Aug 10Metabase SQL injection via password reset endpoint
CVE-2026-50147
ME
metabase
metabase
7.6
0%
Jul 15Metabase: Arbitrary File Read via MySQL Connection Property Injection
CVE-2026-50148
ME
metabase
metabase
9.1
1%
Jul 15Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
CVE-2026-59826
ME
metabase
metabase
9.1
1%
Jul 9Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
CVE-2026-59827
ME
metabase
metabase
8.8
4%
Jul 9Metabase: Unsafe Deserialization of H2 Query Results
CVE-2026-33725
ME
metabase
metabase
7.2
1%
Mar 27Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import
CVE-2026-27464
ME
Metabase
Metabase
6.5
0%
Feb 21Metabase is an open-source data analytics platform
CVE-2026-22805
ME
Metabase
Metabase
8.6
0%
Jan 12Metabase is an open-source data analytics platform
CVE-2025-5895
ME
Metabase
Metabase
7.5
1%
Jun 9A vulnerability was found in Metabase 54.10
CVE-2025-27141
ME
Metabase
Metabase
6.5
0%
Feb 24Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software
CVE-2023-37470
ME
Metabase
Metabase
9.8
1%
Aug 4Metabase is an open-source business intelligence and analytics platform
CVE-2023-38646
ME
Metabase
Metabase
9.8
99%
Jul 21Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level
CVE-2023-32680
ME
Metabase
Metabase
9.6
1%
May 18Metabase is an open source business analytics engine
CVE-2023-23629
ME
Metabase
Metabase
6.3
0%
Jan 28Metabase is an open source data analytics platform
CVE-2023-23628
ME
Metabase
Metabase
4.1
0%
Jan 28Metabase is an open source data analytics platform
CVE-2022-39361
ME
metabase
metabase
8.8
1%
Oct 26Metabase vulnerable to Remote Code Execution via H2
CVE-2022-39360
ME
metabase
metabase
6.5
1%
Oct 26Metabase SSO users able to circumvent IdP login by doing password reset
CVE-2022-39359
ME
metabase
metabase
6.5
1%
Oct 26Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs
CVE-2022-39358
ME
metabase
metabase
6.5
1%
Oct 26Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
CVE-2022-43776
ME
Metabase
Metabase
6.5
1%
Oct 26The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks
CVE-2022-39362
ME
metabase
metabase
8.8
1%
Oct 26Metabase vulnerable to arbitrary SQL execution from queryhash
CVE-2022-24855
ME
Metabase
Metabase
5.4
1%
Apr 14Metabase is an open source business intelligence and analytics application
CVE-2022-24854
ME
Metabase
Metabase
8.8
1%
Apr 14Metabase is an open source business intelligence and analytics application
CVE-2022-24853
ME
Metabase
Metabase
5.3
3%
Apr 14Metabase is an open source business intelligence and analytics application
CVE-2021-41277
In wildKEV
ME
metabase
metabase
7.5
97%
Nov 17GeoJSON URL validation can expose server files and environment variables to unauthorized users
CVE-2018-0697
ME
Metabase
Metabase
6.1
1%
Nov 15Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors