LI
Product
lightdash
7
CVEs
0
On KEV
8.3
Max CVSS
3
New 30D
Severity mix
Critical 0High 4Medium 3Low 0
Watch
Add lightdash to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-61654 New | 8.3 | Oct 29 | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key Affected: < 0.3214.0 |
| CVE-2026-61576 New | 8.3 | Oct 29 | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key Affected: < 0.3214.0 |
| CVE-2023-35844 | 7.5 | Jun 19 | packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow Affected: before 0.510.3 |
| CVE-2024-6586 | 7.3 | Aug 30 | Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards Affected: 0.1024.6 before 0.1027.2 |
| CVE-2026-72846 | 6.4 | Aug 20 | Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery Affected: before 1.146.4 |
| CVE-2024-6585 | 5.4 | Aug 30 | Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote… Affected: 0.1024.6 before 0.1042.2 |
| CVE-2026-108747 | 4.2 | Oct 11 | Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion Affected: through 2.556.0 |
Showing 7