Apache Software Foundation Apache Superset

• CVE-2023-27524 High 8.9 Exploited Apache Superset: Session validation vulnerability when using provided default SECRET_KEY 98.1%
• CVE-2026-23985 Medium 5.3 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser 0.7%
• CVE-2026-23981 Medium 5.3 Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification 0.6%
• CVE-2026-23969 Medium 5.3 Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering 0.7%
• CVE-2026-23980 Medium 5.3 Apache Superset: Improper Neutralization of Special Elements used in a SQL Command 0.7%
• CVE-2026-23982 High 7.1 Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass 0.5%
• CVE-2026-23983 Low 2.3 Apache Superset: Sensitive Data Exposure via REST API (disabled by default) 0.5%
• CVE-2026-23984 High 7.1 Apache Superset: SQLLab Read-Only Bypass on PostgreSQL 0.4%
• CVE-2025-55675 Medium 5.3 Apache Superset: Incorrect datasource authorization on REST API 0.6%
• CVE-2025-55674 Medium 5.3 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions 0.8%
• CVE-2025-55672 Medium 5.3 Apache Superset: Stored XSS on charts metadata 0.8%
• CVE-2025-55673 Medium 5.3 Apache Superset: Metadata exposure in embedded charts 0.6%
• CVE-2025-48912 High 7.1 Apache Superset: Improper authorization bypass on row level security via SQL Injection 0.8%
• CVE-2025-27696 Medium 5.3 Apache Superset: Incorrect authorization leading to resource ownership takeover 1.3%
• CVE-2024-55633 High 7.1 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access 2.8%
• CVE-2024-53949 High 7.6 Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled 0.7%
• CVE-2024-53948 Medium 5.3 Apache Superset: Error verbosity exposes metadata in analytics databases 0.9%
• CVE-2024-53947 Low 2.3 Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions 0.8%
• CVE-2024-39887 Medium 4.3 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions 4.4%
• CVE-2024-34693 Medium 6.8 Apache Superset: Server arbitrary file read 1.6%
• CVE-2024-28148 Medium 4.3 Apache Superset: Incorrect datasource authorization on explore REST API 0.7%
• CVE-2024-26016 Medium 4.3 Apache Superset: Improper authorization validation on dashboards and charts import 0.9%
• CVE-2024-24779 Medium 5.0 Apache Superset: Improper data authorization when creating a new dataset 0.7%
• CVE-2024-24772 Medium 4.3 Apache Superset: Improper Neutralisation of custom SQL on embedded context 1.0%
• CVE-2024-24773 Medium 4.9 Apache Superset: Improper validation of SQL statements allows for unauthorized access to data 0.8%
• CVE-2024-27315 Medium 4.3 Apache Superset: Improper error handling on alerts 1.0%
• CVE-2024-23952 Medium 6.5 Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104) 1.7%
• CVE-2023-49657 Critical 9.6 Apache Superset: Stored XSS in Dashboard Title and Chart Title 0.8%
• CVE-2023-49734 High 7.7 Apache Superset: Privilege Escalation Vulnerability 0.9%
• CVE-2023-49736 Medium 6.5 Apache Superset: SQL Injection on where_in JINJA macro 1.2%
• CVE-2023-46104 Medium 6.5 Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb 1.7%
• CVE-2023-42504 Medium 5.8 Apache Superset: Lack of rate limiting allows for possible denial of service 1.1%
• CVE-2023-42505 Medium 4.3 Apache Superset: Sensitive information disclosure on db connection details 1.0%
• CVE-2023-42502 Medium 4.8 Apache Superset: Open Redirect Vulnerability 0.8%
• CVE-2023-43701 Medium 4.3 Apache Superset: Stored XSS on API endpoint 1.0%
• CVE-2023-42501 Medium 4.3 Apache Superset: Unnecessary read permissions within the Gamma role 0.9%
• CVE-2023-40610 Medium 6.3 Apache Superset: Privilege escalation with default examples database 1.3%
• CVE-2023-32672 Medium 4.3 Apache Superset: SQL parser edge case bypasses data access authorization 1.0%
• CVE-2023-37941 Medium 6.6 Apache Superset: Metadata db write access can lead to remote code execution 35.5%
• CVE-2023-39265 Low 3.8 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections 86.0%
• CVE-2023-39264 Medium 4.3 Apache Superset: Stack traces enabled by default 1.1%
• CVE-2023-27523 Medium 5.0 Apache Superset: Improper data permission validation on Jinja templated queries 1.0%
• CVE-2023-36388 Medium 4.3 Apache Superset: Improper API permission for low privilege users allows for SSRF 1.1%
• CVE-2023-27526 Medium 4.3 Apache Superset: Improper Authorization check on import charts 1.2%
• CVE-2023-36387 Medium 5.4 Apache Superset: Improper API permission for low privilege users 1.1%
• CVE-2023-30776 Medium 4.9 Apache Superset: Database connection password leak 2.1%
• CVE-2023-25504 Medium 4.9 Apache Superset: Possible SSRF on import datasets 1.0%
• CVE-2023-27525 Low 3.1 Apache Superset: Incorrect default permissions for Gamma role 0.8%
• CVE-2022-41703 Medium 5.4 Apache Superset: SQL injection vulnerability in adhoc clauses 1.2%
• CVE-2022-45438 Medium 5.3 Apache Superset: Dashboard metadata information leak 1.3%