apache-superset vulnerabilities
CVEs whose affected-version data names the apache-superset package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
53 CVEsRSS
CVE-2023-43701Medium· 4.3Apache Superset Cross-site Scripting vulnerability
Apache Superset Cross-site Scripting vulnerability
CVE-2023-42501Medium· 4.3Apache Superset has Incorrect Default Permissions
Apache Superset has Incorrect Default Permissions
CVE-2023-27523Medium· 5.0Apache Superset vulnerable to improper data authorization
Apache Superset vulnerable to improper data authorization
CVE-2023-39265Medium· 6.5PoCApache Superset Improper Input Validation vulnerability
Apache Superset Improper Input Validation vulnerability
CVE-2023-37941Medium· 6.6PoCApache Superset Deserialization of Untrusted Data vulnerability
Apache Superset Deserialization of Untrusted Data vulnerability
CVE-2023-39264Medium· 4.3Apache Superset may expose internal traces on REST API endpoints
Apache Superset may expose internal traces on REST API endpoints
CVE-2023-27526Medium· 4.3Apache Superset users may incorrectly create resources using the import charts feature
Apache Superset users may incorrectly create resources using the import charts feature
CVE-2023-36387Medium· 5.4Apache Superset has improper default REST API permission for Gamma users
Apache Superset has improper default REST API permission for Gamma users
CVE-2023-32672Medium· 4.3Apache Superset has incorrect authorization check
Apache Superset has incorrect authorization check
CVE-2023-36388Medium· 4.3Apache Superset Server Side Request Forgery vulnerability
Apache Superset Server Side Request Forgery vulnerability
CVE-2023-25504Medium· 6.5Apache Superset Server-Side Request Forgery vulnerability
Apache Superset Server-Side Request Forgery vulnerability
CVE-2023-30776Medium· 6.5Apache Superset vulnerable to Exposure of Sensitive Information
Apache Superset vulnerable to Exposure of Sensitive Information
CVE-2023-27524High· 8.9CISA KEVPoCApache superset missing check for default SECRET_KEY
Apache superset missing check for default SECRET_KEY
CVE-2023-27525Medium· 4.3Apache Superset vulnerable to Improper Authorization
Apache Superset vulnerable to Improper Authorization
CVE-2022-43720Medium· 5.4Apache Superset vulnerable to Injection
Apache Superset vulnerable to Injection
CVE-2022-43721Medium· 5.4Apache Superset Open Redirect vulnerability
Apache Superset Open Redirect vulnerability
CVE-2022-41703Medium· 5.4Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
CVE-2022-43717Medium· 5.4Apache Superset vulnerable to Cross-site Scripting
Apache Superset vulnerable to Cross-site Scripting
CVE-2022-45438Medium· 5.3Apache Superset has Improper Access Control
Apache Superset has Improper Access Control
CVE-2022-43718Medium· 5.4Apache Superset is vulnerable to Cross-Site Scripting (XSS)
Apache Superset is vulnerable to Cross-Site Scripting (XSS)
CVE-2022-43719High· 8.8Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints
Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints
CVE-2021-37839Medium· 4.3Apache Superset allows authenticated users to access metadata they have no permission to
Apache Superset allows authenticated users to access metadata they have no permission to
CVE-2021-28125Medium· 6.1Open Redirect in Apache Superset
Open Redirect in Apache Superset