uselotus has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 7.8 (high). None have a confirmed exploitation report. The most common weakness class is CWE-89 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Worst active — by depth score
CVE-2026-115332High· 8.8Lotus through 0.10.2 SQL Injection via Subscription Filter Keys48CVE-2026-115331High· 8.8Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters48CVE-2026-115330High· 8.8Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics48CVE-2026-115334Medium· 6.8Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint37CVE-2026-115333Medium· 5.9Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix32
uselotus vulnerabilities
CVEs affecting uselotus, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-115330High· 8.8Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL thr…
CVE-2026-115331High· 8.8Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values re…
CVE-2026-115329Medium· 5.9Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from …
CVE-2026-115332High· 8.8Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptio…
CVE-2026-115334Medium· 6.8Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organizatio…
CVE-2026-115333Medium· 5.9Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain a…