apache-superset (PyPI)
Advisories
152
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 6.0.0 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "apache-superset>=6.0.0"poetry
poetry add "apache-superset>=6.0.0"uv
uv add "apache-superset>=6.0.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mwf2-qr4v-94h2 Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections |
Medium EPSS 0.41% |
< 6.0.0 | 6.0.0 |
| GHSA-mwf2-qr4v-94h2 Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections |
Medium EPSS 0.41% |
< 6.0.0 | 6.0.0 |
| GHSA-h294-8fxm-m2pj Apache Superset allows authenticated users to view sensitive data without explicit permissions |
Medium EPSS 0.47% |
< 6.0.0 | 6.0.0 |
| GHSA-h294-8fxm-m2pj Apache Superset allows authenticated users to view sensitive data without explicit permissions |
Medium EPSS 0.47% |
< 6.0.0 | 6.0.0 |
| GHSA-3m2g-v7jf-7fxc Apache Superset Improper Authorization allows low-privileged users to bypass access controls |
Medium EPSS 0.51% |
< 6.0.0 | 6.0.0 |
| GHSA-3m2g-v7jf-7fxc Apache Superset Improper Authorization allows low-privileged users to bypass access controls |
Medium EPSS 0.51% |
< 6.0.0 | 6.0.0 |
| GHSA-gvxg-9hqx-f4rg Apache Superset allows privileged users to conduct error-based SQL Injection |
Medium EPSS 0.71% |
< 6.0.0 | 6.0.0 |
| GHSA-gvxg-9hqx-f4rg Apache Superset allows privileged users to conduct error-based SQL Injection |
Medium EPSS 0.71% |
< 6.0.0 | 6.0.0 |
| GHSA-48m2-v2r8-h23m Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine |
Medium EPSS 0.70% |
< 4.1.2 | 4.1.2 |
| GHSA-48m2-v2r8-h23m Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine |
Medium EPSS 0.70% |
< 4.1.2 | 4.1.2 |
| GHSA-mhpq-m962-mg92 Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access |
Medium EPSS 0.60% |
< 5.0.0 | 5.0.0 |
| GHSA-mhpq-m962-mg92 Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access |
Medium EPSS 0.60% |
< 5.0.0 | 5.0.0 |
| GHSA-fxgf-3xh6-m2pp Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions |
Medium EPSS 0.69% |
< 5.0.0 | 5.0.0 |
| GHSA-fxgf-3xh6-m2pp Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions |
Medium EPSS 0.69% |
< 5.0.0 | 5.0.0 |
| GHSA-9g5x-mm39-wg9r Apache Superset data query improperly discloses database schema information to low-privileged guest user |
Medium EPSS 0.57% |
< 4.1.3.post1 | 4.1.3.post1 |
| GHSA-9g5x-mm39-wg9r Apache Superset data query improperly discloses database schema information to low-privileged guest user |
Medium EPSS 0.57% |
< 4.1.3.post1 | 4.1.3.post1 |
| GHSA-fj97-2v9x-w5m4 Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability |
Medium EPSS 0.74% |
< 5.0.0 | 5.0.0 |
| GHSA-fj97-2v9x-w5m4 Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability |
Medium EPSS 0.74% |
< 5.0.0 | 5.0.0 |
| GHSA-8w7f-8pr9-xgwj Apache Superset: Improper authorization bypass on row level security via SQL Injection |
Medium EPSS 0.79% |
< 4.1.2 | 4.1.2 |
| GHSA-8w7f-8pr9-xgwj Apache Superset: Improper authorization bypass on row level security via SQL Injection |
Medium EPSS 0.79% |
< 4.1.2 | 4.1.2 |
| GHSA-w6c7-j32f-rq8j Apache Superset Allows Ownership Takeover |
High EPSS 1.30% |
< 4.1.2 | 4.1.2 |
| GHSA-w6c7-j32f-rq8j Apache Superset Allows Ownership Takeover |
High EPSS 1.30% |
< 4.1.2 | 4.1.2 |
| GHSA-787v-v9vq-4rgv Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access |
Medium EPSS 2.81% |
< 4.1.0 | 4.1.0 |
| GHSA-787v-v9vq-4rgv Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access |
Medium EPSS 2.81% |
< 4.1.0 | 4.1.0 |
| GHSA-35fc-9hrj-3585 Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled |
Medium EPSS 0.72% |
>= 2.0.0, < 4.1.0 | 4.1.0 |
| GHSA-35fc-9hrj-3585 Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled |
Medium EPSS 0.72% |
>= 2.0.0, < 4.1.0 | 4.1.0 |
| GHSA-2cx9-54hp-r698 Apache Superset: Error verbosity exposes metadata in analytics databases |
Medium EPSS 0.85% |
< 4.1.0 | 4.1.0 |
| GHSA-2cx9-54hp-r698 Apache Superset: Error verbosity exposes metadata in analytics databases |
Medium EPSS 0.85% |
< 4.1.0 | 4.1.0 |
| GHSA-92qf-8gh3-gwcm Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions |
Critical EPSS 0.84% |
< 4.1.0 | 4.1.0 |
| GHSA-92qf-8gh3-gwcm Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions |
Critical EPSS 0.84% |
< 4.1.0 | 4.1.0 |
| GHSA-2q6j-vpvr-6pvj Apache Superset vulnerable to improper SQL authorization |
Critical EPSS 4.43% |
< 4.0.2 | 4.0.2 |
| GHSA-2q6j-vpvr-6pvj Apache Superset vulnerable to improper SQL authorization |
Critical EPSS 4.43% |
< 4.0.2 | 4.0.2 |
| GHSA-hcr7-cqwc-q5gq Apache Superset server arbitrary file read |
Medium EPSS 1.58% |
< 3.1.3>= 4.0.0, < 4.0.1 | 3.1.34.0.1 |
| GHSA-hcr7-cqwc-q5gq Apache Superset server arbitrary file read |
Medium EPSS 1.58% |
>= 4.0.0, < 4.0.1 | 4.0.1 |
| GHSA-hcr7-cqwc-q5gq Apache Superset server arbitrary file read |
Medium EPSS 1.58% |
< 3.1.3 | 3.1.3 |
| GHSA-299q-3p96-5898 Apache Superset Incorrect Authorization vulnerability |
Medium EPSS 0.70% |
< 3.1.2 | 3.1.2 |
| GHSA-299q-3p96-5898 Apache Superset Incorrect Authorization vulnerability |
Medium EPSS 0.70% |
< 3.1.2 | 3.1.2 |
| GHSA-3v9r-885j-762g Apache Superset: Improper authorization validation on dashboards and charts import |
Medium EPSS 0.87% |
< 3.0.4 | 3.0.4 |
| GHSA-3v9r-885j-762g Apache Superset: Improper authorization validation on dashboards and charts import |
Medium EPSS 0.87% |
< 3.0.4>= 3.1.0, < 3.1.1 | 3.0.43.1.1 |
| GHSA-3v9r-885j-762g Apache Superset: Improper authorization validation on dashboards and charts import |
Medium EPSS 0.87% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-wr6g-9wcr-cmqj Apache Superset: Improper data authorization when creating a new dataset |
Medium EPSS 0.73% |
< 3.0.4 | 3.0.4 |
| GHSA-wr6g-9wcr-cmqj Apache Superset: Improper data authorization when creating a new dataset |
Medium EPSS 0.73% |
< 3.0.4>= 3.1.0, < 3.1.1 | 3.0.43.1.1 |
| GHSA-wr6g-9wcr-cmqj Apache Superset: Improper data authorization when creating a new dataset |
Medium EPSS 0.73% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-5474-f7g5-273q Apache Superset: Improper validation of SQL statements allows for unauthorized access to data |
Medium EPSS 0.78% |
< 3.0.4>= 3.1.0, < 3.1.1 | 3.0.43.1.1 |
| GHSA-5474-f7g5-273q Apache Superset: Improper validation of SQL statements allows for unauthorized access to data |
Medium EPSS 0.78% |
< 3.0.4 | 3.0.4 |
| GHSA-5474-f7g5-273q Apache Superset: Improper validation of SQL statements allows for unauthorized access to data |
Medium EPSS 0.78% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-m6jm-3v38-76j4 Apache Superset: Improper Neutralization of custom SQL on embedded context |
Medium EPSS 0.95% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-m6jm-3v38-76j4 Apache Superset: Improper Neutralization of custom SQL on embedded context |
Medium EPSS 0.95% |
< 3.0.4>= 3.1.0, < 3.1.1 | 3.0.43.1.1 |
| GHSA-m6jm-3v38-76j4 Apache Superset: Improper Neutralization of custom SQL on embedded context |
Medium EPSS 0.95% |
< 3.0.4 | 3.0.4 |
| GHSA-h7r6-8qmm-hj5r Apache Superset: Improper error handling on alerts |
Medium EPSS 0.98% |
< 3.0.4>= 3.1.0, < 3.1.1 | 3.0.43.1.1 |
| GHSA-h7r6-8qmm-hj5r Apache Superset: Improper error handling on alerts |
Medium EPSS 0.98% |
< 3.0.4 | 3.0.4 |
| GHSA-h7r6-8qmm-hj5r Apache Superset: Improper error handling on alerts |
Medium EPSS 0.98% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-v7q3-5rqm-x7m9 Duplicate Advisory: Apache Superset uncontrolled resource consumption Withdrawn |
Medium EPSS 1.70% |
>= 3.0.0, < 3.0.1 | 3.0.1 |
| GHSA-v7q3-5rqm-x7m9 Duplicate Advisory: Apache Superset uncontrolled resource consumption Withdrawn |
Medium EPSS 1.70% |
< 2.1.2 | 2.1.2 |
| GHSA-rwhh-6x83-84v6 Cross-site Scripting in Apache superset |
Medium EPSS 0.84% |
< 3.0.3 | 3.0.3 |
| GHSA-rwhh-6x83-84v6 Cross-site Scripting in Apache superset |
Medium EPSS 0.84% |
< 3.0.3 | 3.0.3 |
| GHSA-jfxj-xf67-x723 Apache Superset SQL injection vulnerability |
High EPSS 1.19% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-jfxj-xf67-x723 Apache Superset SQL injection vulnerability |
High EPSS 1.19% |
< 2.1.3>= 3.0.0, < 3.0.2 | 2.1.33.0.2 |
| GHSA-jfxj-xf67-x723 Apache Superset SQL injection vulnerability |
High EPSS 1.19% |
< 2.1.3 | 2.1.3 |
| GHSA-g49j-j489-3xpf Apache Superset incorrect write permissions vulnerability |
Medium EPSS 0.95% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-g49j-j489-3xpf Apache Superset incorrect write permissions vulnerability |
Medium EPSS 0.95% |
< 2.1.3>= 3.0.0, < 3.0.2 | 2.1.33.0.2 |
| GHSA-g49j-j489-3xpf Apache Superset incorrect write permissions vulnerability |
Medium EPSS 0.95% |
< 2.1.3 | 2.1.3 |
| GHSA-95mg-jgfx-54v9 Apache Superset uncontrolled resource consumption |
Medium EPSS 1.67% |
>= 3.0.0, < 3.1.0rc1 | 3.1.0rc1 |
| GHSA-95mg-jgfx-54v9 Apache Superset uncontrolled resource consumption |
Medium EPSS 1.67% |
< 2.1.2>= 3.0.0, < 3.1.0rc1 | 2.1.23.1.0rc1 |
| GHSA-95mg-jgfx-54v9 Apache Superset uncontrolled resource consumption |
Medium EPSS 1.67% |
< 2.1.2 | 2.1.2 |
| GHSA-3hp7-4qq4-v5c6 Apache Superset Allocation of Resources Without Limits or Throttling vulnerability |
Medium EPSS 1.15% |
< 3.0.0 | 3.0.0 |
| GHSA-3hp7-4qq4-v5c6 Apache Superset Allocation of Resources Without Limits or Throttling vulnerability |
Medium EPSS 1.15% |
< 3.0.0 | 3.0.0 |
| GHSA-fgpw-4w69-j256 Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability |
Medium EPSS 1.02% |
< 3.0.0 | 3.0.0 |
| GHSA-fgpw-4w69-j256 Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability |
Medium EPSS 1.02% |
< 3.0.0 | 3.0.0 |
| GHSA-hc74-9vjm-c9xv Apache Superset Open Redirect vulnerability |
Medium EPSS 0.83% |
< 3.0.0 | 3.0.0 |
| GHSA-hc74-9vjm-c9xv Apache Superset Open Redirect vulnerability |
Medium EPSS 0.83% |
< 3.0.0 | 3.0.0 |
| GHSA-392c-vjfv-h7wr Duplicate Advisory: Apache Superset - Elevation of Privilege Withdrawn |
Medium | < 2.1.2 | 2.1.2 |
| GHSA-wq8q-99p5-xfrw Apache Superset Cross-site Scripting vulnerability |
Medium EPSS 1.00% |
< 2.1.2 | 2.1.2 |
| GHSA-wq8q-99p5-xfrw Apache Superset Cross-site Scripting vulnerability |
Medium EPSS 1.00% |
< 2.1.2 | 2.1.2 |
| GHSA-vv65-fjfj-4736 Apache Superset has Incorrect Default Permissions |
Medium EPSS 0.86% |
< 2.1.2 | 2.1.2 |
| GHSA-vv65-fjfj-4736 Apache Superset has Incorrect Default Permissions |
Medium EPSS 0.86% |
< 2.1.2 | 2.1.2 |
| GHSA-f678-j579-4xf5 Apache Superset - Elevation of Privilege |
High EPSS 1.33% |
< 2.1.2 | 2.1.2 |
| GHSA-f678-j579-4xf5 Apache Superset - Elevation of Privilege |
High EPSS 1.33% |
< 2.1.2 | 2.1.2 |
| GHSA-fm4q-j8g4-c9j4 Apache Superset Improper Input Validation vulnerability |
Medium EPSS 86.03% |
< 2.1.1 | 2.1.1 |
| GHSA-fm4q-j8g4-c9j4 Apache Superset Improper Input Validation vulnerability |
Medium EPSS 86.03% |
<= 2.1.0 | No fix yet |
| GHSA-fj4x-m62j-wvwg Apache Superset Deserialization of Untrusted Data vulnerability |
Medium EPSS 35.45% |
>= 1.5.0, < 2.1.1 | 2.1.1 |
| GHSA-fj4x-m62j-wvwg Apache Superset Deserialization of Untrusted Data vulnerability |
Medium EPSS 35.45% |
>= 1.5.0, < 2.1.1 | 2.1.1 |
| GHSA-95ch-p3gw-23qg Apache Superset has incorrect authorization check |
Medium EPSS 1.04% |
<= 2.1.0 | No fix yet |
| GHSA-95ch-p3gw-23qg Apache Superset has incorrect authorization check |
Medium EPSS 1.04% |
< 2.1.1 | 2.1.1 |
| GHSA-cpvx-2365-466c Apache Superset may expose internal traces on REST API endpoints |
Medium EPSS 1.13% |
<= 2.1.0 | No fix yet |
| GHSA-cpvx-2365-466c Apache Superset may expose internal traces on REST API endpoints |
Medium EPSS 1.13% |
< 2.1.1 | 2.1.1 |
| GHSA-4fg9-5w46-xmrj Apache Superset Server Side Request Forgery vulnerability |
Medium EPSS 1.11% |
< 2.1.1 | 2.1.1 |
| GHSA-4fg9-5w46-xmrj Apache Superset Server Side Request Forgery vulnerability |
Medium EPSS 1.11% |
<= 2.1.0 | No fix yet |
| GHSA-9832-mgg4-3gr6 Apache Superset has improper default REST API permission for Gamma users |
Medium EPSS 1.13% |
<= 2.1.0 | No fix yet |
| GHSA-9832-mgg4-3gr6 Apache Superset has improper default REST API permission for Gamma users |
Medium EPSS 1.13% |
<= 2.1.0 | No fix yet |
| GHSA-9qc3-p9jq-2x27 Apache Superset users may incorrectly create resources using the import charts feature |
Medium EPSS 1.21% |
< 2.1.1 | 2.1.1 |
| GHSA-9qc3-p9jq-2x27 Apache Superset users may incorrectly create resources using the import charts feature |
Medium EPSS 1.21% |
<= 2.1.0 | No fix yet |
| GHSA-v594-2c97-hx38 Apache Superset vulnerable to improper data authorization |
Medium EPSS 1.02% |
< 2.1.1 | 2.1.1 |
| GHSA-v594-2c97-hx38 Apache Superset vulnerable to improper data authorization |
Medium EPSS 1.02% |
<= 2.1.0 | No fix yet |
| GHSA-cmjc-52fg-9f7j Apache Superset vulnerable to Exposure of Sensitive Information |
Medium EPSS 2.07% |
>= 1.3.0, < 2.1.0 | 2.1.0 |
| GHSA-cmjc-52fg-9f7j Apache Superset vulnerable to Exposure of Sensitive Information |
Medium EPSS 2.07% |
>= 1.3.0, < 2.1.0 | 2.1.0 |
| GHSA-fxjg-28fm-pfxh Apache Superset Server-Side Request Forgery vulnerability |
Medium EPSS 0.96% |
< 2.1.0 | 2.1.0 |
| GHSA-fxjg-28fm-pfxh Apache Superset Server-Side Request Forgery vulnerability |
Medium EPSS 0.96% |
< 2.1.0 | 2.1.0 |
| GHSA-5cx2-vq3h-x52c Apache superset missing check for default SECRET_KEY Known exploited |
Critical EPSS 98.15% |
< 2.1.0 | 2.1.0 |
| GHSA-5cx2-vq3h-x52c Apache superset missing check for default SECRET_KEY Known exploited |
Critical EPSS 98.15% |
< 2.1.0 | 2.1.0 |
| GHSA-5cx2-vq3h-x52c Apache superset missing check for default SECRET_KEY Known exploited |
Critical EPSS 98.15% |
< 2.1.0 | 2.1.0 |
| GHSA-7jhg-8m74-6f6g Apache Superset vulnerable to Improper Authorization |
Medium EPSS 0.78% |
<= 2.0.1 | No fix yet |
| GHSA-7jhg-8m74-6f6g Apache Superset vulnerable to Improper Authorization |
Medium EPSS 0.78% |
< 2.1.0 | 2.1.0 |
| GHSA-7222-r37x-8q3m Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints |
High EPSS 0.59% |
No fix yet | |
| GHSA-cxvp-3frm-3876 Apache Superset's SQL Alchemy connector vulnerable to SQL Injection |
Medium EPSS 1.24% |
< 1.5.3>= 2.0.0, < 2.0.1 | 1.5.32.0.1 |
| GHSA-cxvp-3frm-3876 Apache Superset's SQL Alchemy connector vulnerable to SQL Injection |
Medium EPSS 1.24% |
No fix yet | |
| GHSA-cxvp-3frm-3876 Apache Superset's SQL Alchemy connector vulnerable to SQL Injection |
Medium EPSS 1.24% |
<= 1.5.2 | No fix yet |
| GHSA-9f88-wg5r-947j Apache Superset vulnerable to Cross-site Scripting |
Medium EPSS 1.29% |
< 1.5.3>= 2.0.0, < 2.0.1 | 1.5.32.0.1 |
| GHSA-9f88-wg5r-947j Apache Superset vulnerable to Cross-site Scripting |
Medium EPSS 1.29% |
No fix yet | |
| GHSA-9f88-wg5r-947j Apache Superset vulnerable to Cross-site Scripting |
Medium EPSS 1.29% |
<= 1.5.2 | No fix yet |
| GHSA-79x5-cv79-49rj Apache Superset is vulnerable to Cross-Site Scripting (XSS) |
Medium EPSS 1.17% |
< 1.5.3>= 2.0.0, < 2.0.1 | 1.5.32.0.1 |
| GHSA-79x5-cv79-49rj Apache Superset is vulnerable to Cross-Site Scripting (XSS) |
Medium EPSS 1.17% |
No fix yet | |
| GHSA-79x5-cv79-49rj Apache Superset is vulnerable to Cross-Site Scripting (XSS) |
Medium EPSS 1.17% |
<= 1.5.2 | No fix yet |
| GHSA-7222-r37x-8q3m Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints |
High EPSS 0.59% |
< 1.5.3>= 2.0.0, < 2.0.1 | 1.5.32.0.1 |
| GHSA-7222-r37x-8q3m Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints |
High EPSS 0.59% |
<= 1.5.2 | No fix yet |
| GHSA-8f5j-mgx9-5hm5 Apache Superset has Improper Access Control |
Medium EPSS 1.27% |
< 1.5.3>= 2.0.0, < 2.0.1 | 1.5.32.0.1 |
| GHSA-fpmr-qmgh-42x2 Apache Superset vulnerable to Injection |
Medium EPSS 1.29% |
No fix yet | |
| GHSA-fpmr-qmgh-42x2 Apache Superset vulnerable to Injection |
Medium EPSS 1.29% |
< 1.5.3>= 2.0.0, < 2.0.1 | 1.5.32.0.1 |
| GHSA-8f5j-mgx9-5hm5 Apache Superset has Improper Access Control |
Medium EPSS 1.27% |
No fix yet | |
| GHSA-8f5j-mgx9-5hm5 Apache Superset has Improper Access Control |
Medium EPSS 1.27% |
<= 1.5.2 | No fix yet |
| GHSA-fcg4-pm6h-9xx2 Apache Superset Open Redirect vulnerability |
Medium EPSS 1.03% |
< 1.5.3>= 2.0.0, < 2.0.1 | 1.5.32.0.1 |
| GHSA-fcg4-pm6h-9xx2 Apache Superset Open Redirect vulnerability |
Medium EPSS 1.03% |
No fix yet | |
| GHSA-fcg4-pm6h-9xx2 Apache Superset Open Redirect vulnerability |
Medium EPSS 1.03% |
<= 1.5.2 | No fix yet |
| GHSA-fpmr-qmgh-42x2 Apache Superset vulnerable to Injection |
Medium EPSS 1.29% |
<= 1.5.2 | No fix yet |
| GHSA-748r-5r8q-273m Apache Superset allows authenticated users to access metadata they have no permission to |
Medium EPSS 1.37% |
< 1.5.1 | 1.5.1 |
| GHSA-748r-5r8q-273m Apache Superset allows authenticated users to access metadata they have no permission to |
Medium EPSS 1.37% |
< 1.5.1 | 1.5.1 |
| GHSA-wh73-hpcg-v32j SQL injection in apache-superset |
Critical EPSS 2.90% |
< 1.4.2 | 1.4.2 |
| GHSA-wh73-hpcg-v32j SQL injection in apache-superset |
Critical EPSS 2.90% |
< 1.4.2 | 1.4.2 |
| GHSA-hhm3-48h2-597v Insufficiently Protected Credentials in Apache Superset |
Medium EPSS 7.86% |
< 1.4.0 | 1.4.0 |
| GHSA-hhm3-48h2-597v Insufficiently Protected Credentials in Apache Superset |
Medium EPSS 7.86% |
< 1.4.0 | 1.4.0 |
| GHSA-5fp8-c45m-256p Improper Encoding or Escaping of Output in Apache Superset |
Medium EPSS 1.82% |
< 1.3.2 | 1.3.2 |
| GHSA-5fp8-c45m-256p Improper Encoding or Escaping of Output in Apache Superset |
Medium EPSS 1.82% |
< 1.3.2 | 1.3.2 |
| GHSA-42q4-9xf9-f67x Apache Superset allowed for database connections password leak for authenticated users |
Medium EPSS 1.50% |
< 1.3.2 | 1.3.2 |
| GHSA-42q4-9xf9-f67x Apache Superset allowed for database connections password leak for authenticated users |
Medium EPSS 1.50% |
< 1.3.2 | 1.3.2 |
| GHSA-f8vc-f28w-x9c9 Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page |
Medium EPSS 1.65% |
< 1.2.0 | 1.2.0 |
| GHSA-pg8m-4p8j-2p56 Apache Superset SQL Injection when template processing is enabled |
High EPSS 1.76% |
< 1.3.1 | 1.3.1 |
| GHSA-pg8m-4p8j-2p56 Apache Superset SQL Injection when template processing is enabled |
High EPSS 1.76% |
< 1.3.1 | 1.3.1 |
| GHSA-f8vc-f28w-x9c9 Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page |
Medium EPSS 1.65% |
< 1.2.0 | 1.2.0 |
| GHSA-pfwg-rxf4-97c3 Open Redirect in Apache Superset |
Medium EPSS 64.02% |
< 1.1.0 | 1.1.0 |
| GHSA-pfwg-rxf4-97c3 Open Redirect in Apache Superset |
Medium EPSS 64.02% |
< 1.1.0 | 1.1.0 |
| GHSA-w358-rj93-r5qv Apache Superset Stored XSS on Dashboard markdown |
Medium EPSS 86.39% |
< 0.38.1 | 0.38.1 |
| GHSA-w358-rj93-r5qv Apache Superset Stored XSS on Dashboard markdown |
Medium EPSS 86.39% |
< 0.38.1 | 0.38.1 |
| GHSA-77pw-c3j2-5fc8 Plaintext password leak in Apache Superset |
High EPSS 2.02% |
< 0.37.2 | 0.37.2 |
| GHSA-77pw-c3j2-5fc8 Plaintext password leak in Apache Superset |
High EPSS 2.02% |
< 0.37.2 | 0.37.2 |
| GHSA-cj7g-h7rf-h8j9 Apache Superset OS Command Injection |
High EPSS 3.10% |
< 0.37.1 | 0.37.1 |
| GHSA-cj7g-h7rf-h8j9 Apache Superset OS Command Injection |
High EPSS 3.10% |
< 0.37.1 | 0.37.1 |
| GHSA-fxjm-wvj9-9c39 Information disclosure in Apache Superset |
Medium EPSS 1.35% |
>= 0.34.0, < 0.35.2 | 0.35.2 |
| GHSA-fxjm-wvj9-9c39 Information disclosure in Apache Superset |
Medium EPSS 1.35% |
< 0.35.2 | 0.35.2 |
| GHSA-p5w7-qmq6-pmjr Users able to query database metadata in Apache Superset |
Medium EPSS 2.80% |
< 0.31 | 0.31 |
| GHSA-p5w7-qmq6-pmjr Users able to query database metadata in Apache Superset |
Medium EPSS 2.80% |
< 0.31.0 | 0.31.0 |
| GHSA-9c29-9h4m-wg5p Users can view database names in Apache Superset |
Medium EPSS 2.79% |
< 0.32.0 | 0.32.0 |
| GHSA-9c29-9h4m-wg5p Users can view database names in Apache Superset |
Medium EPSS 2.79% |
< 0.32 | 0.32 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor