Known vulnerabilities in Apache Superset

Software CPE: cpe:2.3:a:apache_foundation:apache_superset:*:*:*:*:*:*:*:*
Total vulnerabilities: 61
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Superset Apache Superset is affected by 61 known vulnerabilities: 3 high, 21 medium, 37 low Critical High Medium Low

Vulnerabilities (61)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU114224 - Improper Access Control
CVE-2025-55675
CWE-284 Low
No
No
5.0.0 19.08.2025 SB2025081945
#VU114223 - Exposure of sensitive information to an unauthorized actor
CVE-2025-55673
CWE-200 Medium
No
No
4.1.3 19.08.2025 SB2025081944
#VU114222 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-55672
CWE-79 Low
No
No
5.0.0 19.08.2025 SB2025081945
#VU114221 - Protection Mechanism Failure
CVE-2025-55674
CWE-693 Low
No
No
5.0.0 19.08.2025 SB2025081945
#VU108999 - Improper Authorization
CVE-2025-27696
CWE-285 Medium
No
No
4.1.2 13.05.2025 SB2025051307
#VU101754 - Improper Authorization
CVE-2024-55633
CWE-285 Medium
No
No
4.1.0 12.12.2024 SB2024120960
#VU101366 - Improper Privilege Management
CVE-2024-53949
CWE-269 Medium
No
No
4.1.0 09.12.2024 SB2024120960
#VU101365 - Externally-generated error message containing sensitive information
CVE-2024-53948
CWE-211 Low
No
No
4.1.0 09.12.2024 SB2024120960
#VU101364 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-53947
CWE-89 Low
No
No
4.1.0 09.12.2024 SB2024120960
#VU94374 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-39887
CWE-89 High
No
No
4.0.2 16.07.2024 SB2024071639
#VU92935 - Improper input validation
CVE-2024-34693
CWE-20 Medium
Available
No
3.1.3, 4.0.1 20.06.2024 SB20240620210
#VU89234 - Improper Access Control
CVE-2024-28148
CWE-284 Low
No
No
4.0.0 07.05.2024 SB2024050747
#VU86907 - Improper Access Control
CVE-2024-26016
CWE-284 Low
No
No
3.0.4, 3.1.1 28.02.2024 SB2024022837
#VU86906 - Improper Access Control
CVE-2024-24779
CWE-284 Low
No
No
3.0.4, 3.1.1 28.02.2024 SB2024022837
#VU86905 - Externally-generated error message containing sensitive information
CVE-2024-24772
CWE-211 Low
No
No
3.0.4, 3.1.1 28.02.2024 SB2024022837
#VU86904 - Permissions, Privileges, and Access Controls
CVE-2024-24773
CWE-264 Low
No
No
3.0.4, 3.1.1 28.02.2024 SB2024022837
#VU86903 - Error Handling
CVE-2024-27315
CWE-388 Low
No
No
3.0.4, 3.1.1 28.02.2024 SB2024022837
#VU85982 - Permissions, Privileges, and Access Controls
CVE-2023-49734
CWE-264 Medium
No
No
2.1.3, 3.0.2 31.01.2024 SB2024013164
#VU85981 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-49736
CWE-89 Medium
No
No
2.1.3, 3.0.2 31.01.2024 SB2024013164
#VU85980 - Resource exhaustion
CVE-2023-46104
CWE-400 Medium
No
No
2.1.3, 3.0.2 31.01.2024 SB2024013164


Showing elements 1 - 20 out of 61