Lightdash Lightdash

• CVE-2026-121631 Medium 4.2 Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints 0.2%
• CVE-2026-61654 High 8.3 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key 0.4%
• CVE-2026-61576 High 8.3 Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key 0.4%
• CVE-2026-108747 Medium 4.2 Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion 0.2%
• CVE-2026-72846 Medium 6.4 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery 0.3%
• CVE-2024-6586 High 7.3 Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat 1.9%
• CVE-2024-6585 Medium 5.4 Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to in 0.6%