{"kind": "product", "path": "vulns/pypi/apache-superset", "name": "apache-superset", "product": "apache-superset", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-23969", "noindex": false, "published": "2026-02-24T13:02:55.287Z", "modified": "2026-02-24T18:19:35.336Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00699, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-23969", "title": "Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering", "description": "Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete.\n\nThis issue affects Apache Superset: before 4.1.2.\n\nUsers are recommended to upgrade to version 4.1.2, which fixes the issue.", "references": ["https://lists.apache.org/thread/2q22sp4oj3krcgdkxchhtht0vgwp2wnd", "http://www.openwall.com/lists/oss-security/2026/02/24/4", "https://nvd.nist.gov/vuln/detail/CVE-2026-23969"], "fixes": ["4.1.2"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-23980", "noindex": false, "published": "2026-02-24T12:54:09.946Z", "modified": "2026-02-24T18:19:36.414Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0071, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-23980", "title": "Apache Superset: Improper Neutralization of Special Elements used in a SQL Command", "description": "Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters.\n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4", "http://www.openwall.com/lists/oss-security/2026/02/24/5", "https://nvd.nist.gov/vuln/detail/CVE-2026-23980"], "fixes": ["6.0.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-23982", "noindex": false, "published": "2026-02-24T12:52:44.361Z", "modified": "2026-02-24T18:19:37.487Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00514, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-23982", "title": "Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass", "description": "An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset.\n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fp", "http://www.openwall.com/lists/oss-security/2026/02/24/6", "https://nvd.nist.gov/vuln/detail/CVE-2026-23982"], "fixes": ["6.0.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-23983", "noindex": false, "published": "2026-02-24T12:52:11.347Z", "modified": "2026-02-24T18:19:38.494Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00471, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-23983", "title": "Apache Superset: Sensitive Data Exposure via REST API (disabled by default)", "description": "A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag.\nWhen these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data \n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to ", "references": ["https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww", "http://www.openwall.com/lists/oss-security/2026/02/24/7", "https://nvd.nist.gov/vuln/detail/CVE-2026-23983"], "fixes": ["6.0.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-23984", "noindex": false, "published": "2026-02-24T12:51:07.027Z", "modified": "2026-02-24T18:19:39.664Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00409, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-23984", "title": "Apache Superset: SQLLab Read-Only Bypass on PostgreSQL", "description": "An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection.\nWhile the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements.\n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/72cmgxtvp9pclto4ln1chbs1227nwd26", "http://www.openwall.com/lists/oss-security/2026/02/24/8", "https://nvd.nist.gov/vuln/detail/CVE-2026-23984"], "fixes": ["6.0.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-55675", "noindex": false, "published": "2025-08-14T13:18:53.944Z", "modified": "2025-11-04T21:13:14.265Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.006, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-55675", "title": "Apache Superset: Incorrect datasource authorization on REST API", "description": "Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure.\n\nThis issue affects Apache Superset: before 5.0.0.\n\nUsers are recommended to upgrade to version 5.0.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/op681b4kbd7g84tfjf9omz0sxggbcv33", "http://www.openwall.com/lists/oss-security/2025/08/14/6", "https://nvd.nist.gov/vuln/detail/CVE-2025-55675"], "fixes": ["5.0.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-55674", "noindex": false, "published": "2025-08-14T13:18:10.535Z", "modified": "2025-11-04T21:13:12.950Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00695, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-55674", "title": "Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions", "description": "A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.\n\nThis issue affects Apache Superset: before 5.0.0.\n\nUsers are recommended to upgrade to version 5.0.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/cn49ps15ny3g2b1qzdg5mj7hp47p5jdo", "http://www.openwall.com/lists/oss-security/2025/08/14/5", "https://nvd.nist.gov/vuln/detail/CVE-2025-55674"], "fixes": ["5.0.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-55672", "noindex": false, "published": "2025-08-14T13:17:33.843Z", "modified": "2025-11-04T21:13:10.307Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00742, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-55672", "title": "Apache Superset: Stored XSS on charts metadata", "description": "A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user.\n\nThis issue affects Apache Superset: before 5.0.0.\n\nUsers are recommended to upgrade to version 5.0.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/rvh7fdjfzxzjhcfwoz7twc2brhvochdj", "http://www.openwall.com/lists/oss-security/2025/08/14/4", "https://nvd.nist.gov/vuln/detail/CVE-2025-55672"], "fixes": ["5.0.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-55673", "noindex": false, "published": "2025-08-14T13:16:27.060Z", "modified": "2025-11-04T21:13:11.614Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00574, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-55673", "title": "Apache Superset: Metadata exposure in embedded charts", "description": "When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.\n\nThis issue affects Apache Superset: before 4.1.3.\n\nUsers are recommended to upgrade to version 4.1.3, which fixes the issue.", "references": ["https://lists.apache.org/thread/h2hw756wk4sj4z49blvzkr5fntl9hlf8", "http://www.openwall.com/lists/oss-security/2025/08/14/3", "https://nvd.nist.gov/vuln/detail/CVE-2025-55673"], "fixes": ["4.1.3.post1"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-48912", "noindex": false, "published": "2025-05-30T08:26:15.500Z", "modified": "2025-05-31T00:11:45.502Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00786, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-48912", "title": "Apache Superset: Improper authorization bypass on row level security via SQL Injection", "description": "An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data.\n\nThis issue affects Apache Superset: before 4.1.2.\n\nUsers are recommended to upgrade to version 4.1.2, which fixes the issue.", "references": ["https://lists.apache.org/thread/ms2t2oq218hb7l628trsogo4fj7h1135", "http://www.openwall.com/lists/oss-security/2025/05/30/3", "https://nvd.nist.gov/vuln/detail/CVE-2025-48912"], "fixes": ["4.1.2"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-27696", "noindex": false, "published": "2025-05-13T08:21:21.199Z", "modified": "2025-09-01T09:52:53.293Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.013, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-27696", "title": "Apache Superset: Incorrect authorization leading to resource ownership takeover", "description": "Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.\n\nThis issue affects Apache Superset: through 4.1.1.\n\nUsers are recommended to upgrade to version 4.1.2 or above, which fixes the issue.", "references": ["https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413", "http://www.openwall.com/lists/oss-security/2025/05/12/3", "https://nvd.nist.gov/vuln/detail/CVE-2025-27696"], "fixes": ["4.1.2"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-55633", "noindex": false, "published": "2024-12-12T14:36:02.325Z", "modified": "2025-02-12T09:35:43.626Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.02806, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-55633", "title": "Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access", "description": "Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. \n\nThis issue affects Apache Superset: before 4.1.0.\n\nUsers are recommended to upgrade to version 4.1.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/bwmd17fcvljt9q4cgctp4v09zh3qs7fb", "http://www.openwall.com/lists/oss-security/2024/12/12/1", "https://nvd.nist.gov/vuln/detail/CVE-2024-55633"], "fixes": ["4.1.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-53949", "noindex": false, "published": "2024-12-09T13:35:41.530Z", "modified": "2025-02-12T09:34:57.804Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00716, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-53949", "title": "Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled", "description": "Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.\n\n issue affects Apache Superset: from 2.0.0 before 4.1.0.\n\nUsers are recommended to upgrade to version 4.1.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/d3scbwmfpzbpm6npnzdw5y4owtqqyq8d", "http://www.openwall.com/lists/oss-security/2024/12/09/4", "https://nvd.nist.gov/vuln/detail/CVE-2024-53949"], "fixes": ["4.1.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-53948", "noindex": false, "published": "2024-12-09T13:35:30.932Z", "modified": "2024-12-09T18:03:42.140Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": 0.00855, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-53948", "title": "Apache Superset: Error verbosity exposes metadata in analytics databases", "description": "Generation of Error Message Containing analytics metadata Information in Apache Superset.\n\nThis issue affects Apache Superset: before 4.1.0.\n\nUsers are recommended to upgrade to version 4.1.0, which fixes the issue.", "references": ["https://lists.apache.org/thread/8howpf3png0wrgpls46ggk441oczlfvf", "http://www.openwall.com/lists/oss-security/2024/12/09/3", "https://nvd.nist.gov/vuln/detail/CVE-2024-53948"], "fixes": ["4.1.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-53947", "noindex": false, "published": "2024-12-09T13:35:09.910Z", "modified": "2024-12-09T15:05:21.361Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "low", "epss": 0.00836, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-53947", "title": "Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema.\n\nThis issue affects Apache Superset: <4.1.0.\n\nUsers are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.", "references": ["https://lists.apache.org/thread/hj3gfsjh67vqw12nlrshlsym4bkopjmn", "https://nvd.nist.gov/vuln/detail/CVE-2024-53947"], "fixes": ["4.1.0"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-39887", "noindex": false, "published": "2024-07-16T09:20:10.688Z", "modified": "2025-02-13T17:53:20.299Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.04433, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-39887", "title": "Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions", "description": "An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.\n\nThis issue affects Apache Superset: before 4.0.2.\n\nUsers are recommended to upgrade to v", "references": ["https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqz", "http://www.openwall.com/lists/oss-security/2024/07/16/5", "https://nvd.nist.gov/vuln/detail/CVE-2024-39887"], "fixes": ["4.0.2"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-34693", "noindex": false, "published": "2024-06-20T08:51:55.329Z", "modified": "2025-02-21T16:55:58.529Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.01584, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-34693", "title": "Apache Superset: Server arbitrary file read", "description": "Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table.This issue affects Apache Superset: before 3.1.3 and version 4.0.0\n\nUsers are recommended to upgrade to version 4.0.1 or 3.1.3, which fixes the issue.", "references": ["https://lists.apache.org/thread/1803x1s34m7r71h1k0q1njol8k6fmyon", "http://www.openwall.com/lists/oss-security/2024/06/20/1", "https://nvd.nist.gov/vuln/detail/CVE-2024-34693"], "fixes": ["3.1.3", "4.0.1"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}, {"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}, {"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-28148", "noindex": false, "published": "2024-05-07T13:33:42.137Z", "modified": "2024-08-02T00:48:49.154Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00705, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-28148", "title": "Apache Superset: Incorrect datasource authorization on explore REST API ", "description": "An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2.\n\nUsers are recommended to upgrade to version 3.1.2 or above, which fixes the issue.\n\n", "references": ["https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo", "https://nvd.nist.gov/vuln/detail/CVE-2024-28148"], "fixes": ["3.1.2"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-26016", "noindex": false, "published": "2024-02-28T11:28:38.319Z", "modified": "2025-04-22T15:57:40.166Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00873, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-26016", "title": "Apache Superset: Improper authorization validation on dashboards and charts import", "description": "A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.\n\nThis issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue.", "references": ["https://lists.apache.org/thread/76v1jjcylgk4p3m0258qr359ook3vl8s", "http://www.openwall.com/lists/oss-security/2024/02/28/7", "https://nvd.nist.gov/vuln/detail/CVE-2024-26016"], "fixes": ["3.0.4", "3.1.1"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}, {"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}, {"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-24779", "noindex": false, "published": "2024-02-28T11:28:02.395Z", "modified": "2025-02-13T17:40:23.167Z", "cvss": 5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.00733, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-24779", "title": "Apache Superset: Improper data authorization when creating a new dataset", "description": "Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.\nThis issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.\n\nUsers are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.", "references": ["https://lists.apache.org/thread/xzhz1m5bb9zxhyqgoy4q2d689b3zp4pq", "http://www.openwall.com/lists/oss-security/2024/02/28/6", "https://nvd.nist.gov/vuln/detail/CVE-2024-24779"], "fixes": ["3.0.4", "3.1.1"], "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}, {"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}, {"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}]}], "total": 66, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "apache-superset", "path": "vulns/pypi/apache-superset", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["6.0.0rc4", "6.0.0rc3", "6.0.0rc2", "6.0.0rc1", "5.0.0rc4", "5.0.0rc3", "5.0.0rc2", "5.0.0rc1", "5.0.0", "4.1.4rc1", "4.1.4", "4.1.3.post1"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-02-24T18:19:39.664Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}