- Latest release
- 6.1.0 (May 13, 2026): no advisory affects it
- Newest unaffected release
- 6.1.0 (May 13, 2026), the latest release
- Advisories
- 66 · 1 critical, 8 high, 39 medium, 4 low
- Weekly downloads
- 110.4K
- Dependents
- 4
- Releases
- 83 since 0.34.0 (Sep 18, 2019)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-23969Affects 0.34.0 to 4.1.2rc1 (4.1.2 is outside it)
- CVE-2026-23980Affects 0.34.0 to 6.0.0rc4 (6.0.0 is outside it)
- CVE-2026-23982Affects 0.34.0 to 6.0.0rc4 (6.0.0 is outside it)
- CVE-2026-23983Affects 0.34.0 to 6.0.0rc4 (6.0.0 is outside it)
- CVE-2026-23984Affects 0.34.0 to 6.0.0rc4 (6.0.0 is outside it)
- CVE-2025-55675Affects 0.34.0 to 5.0.0rc4 (5.0.0 is outside it)
- CVE-2025-55674Affects 0.34.0 to 5.0.0rc4 (5.0.0 is outside it)
- CVE-2025-55672Affects 0.34.0 to 5.0.0rc4 (5.0.0 is outside it)
- CVE-2025-55673Affects 0.34.0 to 4.1.3rc2 (4.1.3.post1 is outside it)
- CVE-2025-48912Affects 0.34.0 to 4.1.2rc1 (4.1.2 is outside it)
- CVE-2025-27696Affects 0.34.0 to 4.1.2rc1 (4.1.2 is outside it)
- CVE-2024-55633Affects 0.34.0 to 4.1.0rc4 (4.1.0 is outside it)
Show all 66 advisoriesShow fewer advisories
- CVE-2024-53949Affects 2.0.0 to 4.1.0rc4 (4.1.0 is outside it)
- CVE-2024-53948Affects 0.34.0 to 4.1.0rc4 (4.1.0 is outside it)
- CVE-2024-53947Affects 0.34.0 to 4.1.0rc4 (4.1.0 is outside it)
- CVE-2024-39887Affects 0.34.0 to 4.0.1 (4.0.2 is outside it)
- CVE-2024-34693Affects 0.34.0 to 3.1.2 (3.1.3 is outside it); 4.0.0 (4.0.1 is outside it)
- CVE-2024-28148Affects 0.34.0 to 3.1.1 (3.1.2 is outside it)
- CVE-2024-26016Affects 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2024-24779Affects 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2024-24772Affects 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2024-24773Affects 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2024-27315Affects 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2023-49657Affects 0.34.0 to 3.0.2 (3.0.3 is outside it)
- CVE-2023-49734Affects 0.34.0 to 2.1.2 (2.1.3 is outside it); 3.0.0 to 3.0.1 (3.0.2 is outside it)
- CVE-2023-49736Affects 0.34.0 to 2.1.2 (2.1.3 is outside it); 3.0.0 to 3.0.1 (3.0.2 is outside it)
- CVE-2023-46104Affects 0.34.0 to 2.1.1 (2.1.2 is outside it); 3.0.0 to 3.0.4 (3.1.0rc1 is outside it)
- CVE-2023-42504Affects 0.34.0 to 3.0.0rc4 (3.0.0 is outside it)
- CVE-2023-42505Affects 0.34.0 to 3.0.0rc4 (3.0.0 is outside it)
- CVE-2023-42502Affects 0.34.0 to 3.0.0rc4 (3.0.0 is outside it)
- CVE-2023-43701Affects 0.34.0 to 2.1.1 (2.1.2 is outside it)
- CVE-2023-42501Affects 0.34.0 to 2.1.1 (2.1.2 is outside it)
- CVE-2023-40610Affects 0.34.0 to 2.1.1 (2.1.2 is outside it)
- CVE-2023-32672Affects 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-37941Affects 1.5.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-39265Affects 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-39264Affects 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-27523Affects 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-36388Affects 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-27526Affects 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-36387Affects 0.34.0 to 2.1.0 (2.1.1rc1 is outside it)
- CVE-2023-30776Affects 1.3.0 to 2.0.1 (2.1.0 is outside it)
- CVE-2023-27524Affects 0.34.0 to 2.0.1 (2.1.0 is outside it)
- CVE-2023-25504Affects 0.34.0 to 2.0.1 (2.1.0 is outside it)
- CVE-2023-27525Affects 0.34.0 to 2.0.1 (2.1.0 is outside it)
- CVE-2022-41703Affects 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-45438Affects 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43721Affects 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43720Affects 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43719Affects 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43718Affects 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43717Affects 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2021-37839Affects 0.34.0 to 1.5.0 (1.5.1 is outside it)
- CVE-2022-27479Affects 0.34.0 to 1.4.1 (1.4.2 is outside it)
- CVE-2021-44451Affects 0.34.0 to 1.3.2 (1.4.0 is outside it)
- CVE-2021-42250Affects 0.34.0 to 1.3.1 (1.3.2 is outside it)
- CVE-2021-41972Affects 0.34.0 to 1.3.1 (1.3.2 is outside it)
- CVE-2021-41971Affects 0.34.0 to 1.3.0 (1.3.1 is outside it)
- CVE-2021-32609Affects 0.34.0 to 1.1.0 (1.2.0 is outside it)
- CVE-2021-28125Affects 0.34.0 to 1.0.1 (1.1.0 is outside it)
- CVE-2021-27907Affects 0.34.0 to 0.38.0 (0.38.1 is outside it)
- CVE-2020-13952Affects 0.34.0 to 0.37.1 (0.37.2 is outside it)
- CVE-2020-13948Affects 0.34.0 to 0.37.0 (0.37.1 is outside it)
- CVE-2020-1932Affects 0.34.0 to 0.35.1 (0.35.2 is outside it)
- CVE-2019-12413No published release is affectedNo published release is affected
- CVE-2019-12414No published release is affectedNo published release is affected
Advisories 66
- CVE-2026-23969Medium 5.3
Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering
Affected: fixed in 4.1.2.
Fixed in 4.1.2 (released Mar 24, 2025, 337 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2026-23980Medium 5.3
Apache Superset: Improper Neutralization of Special Elements used in a SQL Command
Affected: fixed in 6.0.0.
Fixed in 6.0.0 (released Dec 18, 2025, 68 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2026-23982High 7.1
Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass
Affected: fixed in 6.0.0.
Fixed in 6.0.0 (released Dec 18, 2025, 68 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2026-23983Low 2.3
Apache Superset: Sensitive Data Exposure via REST API (disabled by default)
Affected: fixed in 6.0.0.
Fixed in 6.0.0 (released Dec 18, 2025, 68 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2026-23984High 7.1
Apache Superset: SQLLab Read-Only Bypass on PostgreSQL
Affected: fixed in 6.0.0.
Fixed in 6.0.0 (released Dec 18, 2025, 68 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2025-55675Medium 5.3
Apache Superset: Incorrect datasource authorization on REST API
Affected: fixed in 5.0.0.
Fixed in 5.0.0 (released Jun 23, 2025, 52 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2025-55674Medium 5.3
Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
Affected: fixed in 5.0.0.
Fixed in 5.0.0 (released Jun 23, 2025, 52 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2025-55672Medium 5.3
Apache Superset: Stored XSS on charts metadata
Affected: fixed in 5.0.0.
Fixed in 5.0.0 (released Jun 23, 2025, 52 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2025-55673Medium 5.3
Apache Superset: Metadata exposure in embedded charts
Affected: fixed in 4.1.3.post1.
Fixed in 4.1.3.post1 (released Jul 17, 2025, 28 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2025-48912High 7.1
Apache Superset: Improper authorization bypass on row level security via SQL Injection
Affected: fixed in 4.1.2.
Fixed in 4.1.2 (released Mar 24, 2025, 67 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2025-27696Medium 5.3
Apache Superset: Incorrect authorization leading to resource ownership takeover
Affected: fixed in 4.1.2.
Fixed in 4.1.2 (released Mar 24, 2025, 50 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-55633High 7.1
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
Affected: fixed in 4.1.0.
Fixed in 4.1.0 (released Nov 13, 2024, 29 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-53949High 7.6
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Affected: from 2.0.0, fixed in 4.1.0.
Fixed in 4.1.0 (released Nov 13, 2024, 26 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-53948Medium 5.3
Apache Superset: Error verbosity exposes metadata in analytics databases
Affected: fixed in 4.1.0.
Fixed in 4.1.0 (released Nov 13, 2024, 26 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-53947Low 2.3
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Affected: fixed in 4.1.0.
Fixed in 4.1.0 (released Nov 13, 2024, 26 days before disclosure).
The latest release, 6.1.0, is not affected.
Show all 66 advisoriesShow fewer advisories
- CVE-2024-39887Medium 4.3
Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
Affected: fixed in 4.0.2.
Fixed in 4.0.2 (released Jul 2, 2024, 14 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-34693Medium 6.8
Apache Superset: Server arbitrary file read
Affected: fixed in 3.1.3; from 4.0.0, fixed in 4.0.1; fixed in 3.1.3; from 4.0.0, fixed in 4.0.1.
Fixed in 3.1.3 (released May 9, 2024, 42 days before disclosure) and 4.0.1 (released May 13, 2024, 38 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-28148Medium 4.3
Apache Superset: Incorrect datasource authorization on explore REST API
Affected: fixed in 3.1.2.
Fixed in 3.1.2 (released Apr 3, 2024, 34 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-26016Medium 4.3
Apache Superset: Improper authorization validation on dashboards and charts import
Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-24779Medium 5.0
Apache Superset: Improper data authorization when creating a new dataset
Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-24772Medium 4.3
Apache Superset: Improper Neutralisation of custom SQL on embedded context
Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-24773Medium 4.9
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2024-27315Medium 4.3
Apache Superset: Improper error handling on alerts
Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-49657Critical 9.6
Apache Superset: Stored XSS in Dashboard Title and Chart Title
Affected: fixed in 3.0.3.
Fixed in 3.0.3 (released Jan 17, 2024, 6 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-49734High 7.7
Apache Superset: Privilege Escalation Vulnerability
Affected: fixed in 2.1.3; from 3.0.0, fixed in 3.0.2; fixed in 2.1.3; from 3.0.0, fixed in 3.0.2.
Fixed in 2.1.3 (released Dec 16, 2023, 3 days before disclosure) and 3.0.2 (released Nov 22, 2023, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-49736Medium 6.5
Apache Superset: SQL Injection on where_in JINJA macro
Affected: fixed in 2.1.3; from 3.0.0, fixed in 3.0.2; fixed in 2.1.3; from 3.0.0, fixed in 3.0.2.
Fixed in 2.1.3 (released Dec 16, 2023, 3 days before disclosure) and 3.0.2 (released Nov 22, 2023, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-46104Medium 6.5
Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb
Affected: fixed in 2.1.2; from 3.0.0, fixed in 3.1.0rc1; fixed in 2.1.2; from 3.0.0, fixed in 3.1.0rc1.
Fixed in 2.1.2 (released Nov 23, 2023, 26 days before disclosure) and 3.1.0rc1 (released Nov 28, 2023, 21 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-42504Medium 5.8
Apache Superset: Lack of rate limiting allows for possible denial of service
Affected: fixed in 3.0.0.
Fixed in 3.0.0 (released Sep 18, 2023, 71 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-42505Medium 4.3
Apache Superset: Sensitive information disclosure on db connection details
Affected: fixed in 3.0.0.
Fixed in 3.0.0 (released Sep 18, 2023, 71 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-42502Medium 4.8
Apache Superset: Open Redirect Vulnerability
Affected: fixed in 3.0.0.
Fixed in 3.0.0 (released Sep 18, 2023, 71 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-43701Medium 4.3
Apache Superset: Stored XSS on API endpoint
Affected: fixed in 2.1.2.
Fixed in 2.1.2 (released Nov 23, 2023, 4 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-42501Medium 4.3
Apache Superset: Unnecessary read permissions within the Gamma role
Affected: fixed in 2.1.2.
Fixed in 2.1.2 (released Nov 23, 2023, 4 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-40610Medium 6.3
Apache Superset: Privilege escalation with default examples database
Affected: fixed in 2.1.2.
Fixed in 2.1.2 (released Nov 23, 2023, 4 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-32672Medium 4.3
Apache Superset: SQL parser edge case bypasses data access authorization
Affected: through 2.1.0; fixed in 2.1.1.
Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-37941Medium 6.6
Apache Superset: Metadata db write access can lead to remote code execution
Affected: from 1.5.0, fixed in 2.1.1.
Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-39265Low 3.8
Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
Affected: through 2.1.0; fixed in 2.1.1.
Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-39264Medium 4.3
Apache Superset: Stack traces enabled by default
Affected: through 2.1.0; fixed in 2.1.1.
Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-27523Medium 5.0
Apache Superset: Improper data permission validation on Jinja templated queries
Affected: fixed in 2.1.1; through 2.1.0.
Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-36388Medium 4.3
Apache Superset: Improper API permission for low privilege users allows for SSRF
Affected: fixed in 2.1.1; through 2.1.0.
Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-27526Medium 4.3
Apache Superset: Improper Authorization check on import charts
Affected: fixed in 2.1.1; through 2.1.0.
Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-36387Medium 5.4
Apache Superset: Improper API permission for low privilege users
Affected: through 2.1.0.
Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 6.1.0, is not affected.
- CVE-2023-30776Medium 4.9
Apache Superset: Database connection password leak
Affected: from 1.3.0, fixed in 2.1.0.
Fixed in 2.1.0 (released Apr 5, 2023, 19 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-27524High 8.9 · KEV
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Affected: fixed in 2.1.0.
Fixed in 2.1.0 (released Apr 5, 2023, 19 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-25504Medium 4.9
Apache Superset: Possible SSRF on import datasets
Affected: fixed in 2.1.0.
Fixed in 2.1.0 (released Apr 5, 2023, 12 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2023-27525Low 3.1
Apache Superset: Incorrect default permissions for Gamma role
Affected: through 2.0.1; fixed in 2.1.0.
Fixed in 2.1.0 (released Apr 5, 2023, 12 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2022-41703Medium 5.4
Apache Superset: SQL injection vulnerability in adhoc clauses
Affected: through 1.5.2; versions 2.0.0; fixed in 1.5.3; from 2.0.0, fixed in 2.0.1.
Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2022-45438Medium 5.3
Apache Superset: Dashboard metadata information leak
Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2022-43721Medium 5.4
Apache Superset: Open Redirect Vulnerability
Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2022-43720Medium 5.4
Apache Superset: Improper rendering of user input
Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2022-43719High 8.8
Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2022-43718Medium 5.4
Apache Superset: Cross-Site Scripting vulnerability on upload forms
Affected: through 1.5.2; versions 2.0.0; fixed in 1.5.3; from 2.0.0, fixed in 2.0.1.
Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2022-43717Medium 5.4
Apache Superset: Cross-Site Scripting on dashboards
Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2021-37839Unrated
Improper access to dataset metadata information
Affected: fixed in 1.5.1.
Fixed in 1.5.1 (released Jun 8, 2022, 28 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2022-27479Unrated
SQL injection vulnerability in chart data API
Affected: fixed in 1.4.2.
Fixed in 1.4.2 (released Mar 29, 2022, 15 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2021-44451Unrated
API sensitive information leak
Affected: fixed in 1.4.0.
Fixed in 1.4.0 (released Jan 19, 2022, 13 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2021-42250Unrated
Possible log injection
Affected: fixed in 1.3.2.
Fixed in 1.3.2 (released Oct 20, 2021, 28 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2021-41972Unrated
Credentials leak
Affected: fixed in 1.3.2.
Fixed in 1.3.2 (released Oct 20, 2021, 23 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2021-41971Unrated
Possible SQL Injection when template processing is enabled
Affected: fixed in 1.3.1.
Fixed in 1.3.1 (released Sep 28, 2021, 20 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2021-32609Unrated
XSS vulnerability on Explore page
Affected: fixed in 1.2.0.
Fixed in 1.2.0 (released Jul 2, 2021, 108 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2021-28125Unrated
Apache Superset Open Redirect
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Apr 13, 2021, 14 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2021-27907Unrated
Apache Superset stored XSS on Dashboard markdown
Affected: fixed in 0.38.1.
Fixed in 0.38.1 (released Mar 1, 2021, 4 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2020-13952Unrated
In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto…
Affected: fixed in 0.37.2.
Fixed in 0.37.2 (released Sep 27, 2020, 3 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2020-13948Unrated
While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of…
Affected: fixed in 0.37.1.
Fixed in 0.37.1 (released Sep 15, 2020, 2 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2020-1932Unrated
An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1.
Affected: fixed in 0.35.2; from 0.34.0, fixed in 0.35.2.
Fixed in 0.35.2 (released Jan 15, 2020, 13 days before disclosure).
The latest release, 6.1.0, is not affected.
- CVE-2019-12413Unrated
In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a…
Affected: fixed in 0.31; fixed in 0.31.0.
Fixed in 0.34.0 (released Sep 18, 2019, 89 days before disclosure, the advisory names 0.31, which was never published).
The latest release, 6.1.0, is not affected.
- CVE-2019-12414Unrated
In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab
Affected: fixed in 0.32; fixed in 0.32.0.
Fixed in 0.34.0 (released Sep 18, 2019, 89 days before disclosure, the advisory names 0.32, which was never published).
The latest release, 6.1.0, is not affected.