apache-superset has 52 CVEs on record between 2022 and 2026. The busiest recent month was February 2026 with 5. The median CVSS is 5.4 (medium), with 1 rated critical. 2% have been exploited in the wild, in line with the corpus average.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 2% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —(1)
- Last 90 days
- 0 prev 0
Products
- apache-superset 52
Worst active — by depth score
CVE-2023-27524High· 8.9Apache superset missing check for default SECRET_KEY93CVE-2023-39265Medium· 6.5Apache Superset Improper Input Validation vulnerability65CVE-2023-37941Medium· 6.6Apache Superset Deserialization of Untrusted Data vulnerability55CVE-2024-53947Critical· 9.8Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions54CVE-2024-34693Medium· 6.8Apache Superset server arbitrary file read 50
apache-superset vulnerabilities
CVEs affecting apache-superset, newest first. Open any entry for full detail, references, and exploit status.
52 CVEsRSS
CVE-2023-43701Medium· 4.3Apache Superset Cross-site Scripting vulnerability
Apache Superset Cross-site Scripting vulnerability
CVE-2023-42501Medium· 4.3Apache Superset has Incorrect Default Permissions
Apache Superset has Incorrect Default Permissions
CVE-2023-27523Medium· 5.0Apache Superset vulnerable to improper data authorization
Apache Superset vulnerable to improper data authorization
CVE-2023-39265Medium· 6.5PoCApache Superset Improper Input Validation vulnerability
Apache Superset Improper Input Validation vulnerability
CVE-2023-37941Medium· 6.6PoCApache Superset Deserialization of Untrusted Data vulnerability
Apache Superset Deserialization of Untrusted Data vulnerability
CVE-2023-39264Medium· 4.3Apache Superset may expose internal traces on REST API endpoints
Apache Superset may expose internal traces on REST API endpoints
CVE-2023-27526Medium· 4.3Apache Superset users may incorrectly create resources using the import charts feature
Apache Superset users may incorrectly create resources using the import charts feature
CVE-2023-36387Medium· 5.4Apache Superset has improper default REST API permission for Gamma users
Apache Superset has improper default REST API permission for Gamma users
CVE-2023-32672Medium· 4.3Apache Superset has incorrect authorization check
Apache Superset has incorrect authorization check
CVE-2023-36388Medium· 4.3Apache Superset Server Side Request Forgery vulnerability
Apache Superset Server Side Request Forgery vulnerability
CVE-2023-25504Medium· 6.5Apache Superset Server-Side Request Forgery vulnerability
Apache Superset Server-Side Request Forgery vulnerability
CVE-2023-30776Medium· 6.5Apache Superset vulnerable to Exposure of Sensitive Information
Apache Superset vulnerable to Exposure of Sensitive Information
CVE-2023-27524High· 8.9CISA KEVPoCApache superset missing check for default SECRET_KEY
Apache superset missing check for default SECRET_KEY
CVE-2023-27525Medium· 4.3Apache Superset vulnerable to Improper Authorization
Apache Superset vulnerable to Improper Authorization
CVE-2022-43720Medium· 5.4Apache Superset vulnerable to Injection
Apache Superset vulnerable to Injection
CVE-2022-43721Medium· 5.4Apache Superset Open Redirect vulnerability
Apache Superset Open Redirect vulnerability
CVE-2022-41703Medium· 5.4Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
CVE-2022-43717Medium· 5.4Apache Superset vulnerable to Cross-site Scripting
Apache Superset vulnerable to Cross-site Scripting
CVE-2022-45438Medium· 5.3Apache Superset has Improper Access Control
Apache Superset has Improper Access Control
CVE-2022-43718Medium· 5.4Apache Superset is vulnerable to Cross-Site Scripting (XSS)
Apache Superset is vulnerable to Cross-Site Scripting (XSS)
CVE-2022-43719High· 8.8Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints
Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints
CVE-2021-37839Medium· 4.3Apache Superset allows authenticated users to access metadata they have no permission to
Apache Superset allows authenticated users to access metadata they have no permission to