ME
Vendor
metabase
34
CVEs
2
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-103928 | ME metabase metabase | 9.3 | Oct 13 | Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions |
| CVE-2026-92813 | ME Metabase metabase | 4.9 | Sep 16 | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass |
| CVE-2026-86116 | ME metabase metabase | 6.5 | Sep 5 | Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API |
| CVE-2026-72900 | ME Metabase Metabase | 6.5 | Aug 10 | Metabase information exposure |
| CVE-2026-72899 | ME Metabase Metabase | 10.0 | Aug 10 | Metabase SQL injection via public card or dashboard |
| CVE-2026-72898 In wildKEV | ME Metabase Metabase | 10.0 | Aug 10 | Metabase SQL injection via password reset endpoint |
| CVE-2026-50147 | ME metabase metabase | 7.6 | Jul 15 | Metabase: Arbitrary File Read via MySQL Connection Property Injection |
| CVE-2026-50148 | ME metabase metabase | 9.1 | Jul 15 | Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write |
| CVE-2026-59826 | ME metabase metabase | 9.1 | Jul 9 | Metabase: Arbitrary Code Execution via Database Connection Detail Bypass |
| CVE-2026-59827 | ME metabase metabase | 8.8 | Jul 9 | Metabase: Unsafe Deserialization of H2 Query Results |
| CVE-2026-33725 | ME metabase metabase | 7.2 | Mar 27 | Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import |
| CVE-2026-27464 | ME metabase metabase | 6.5 | Feb 21 | Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE |
| CVE-2026-22805 | ME metabase metabase | 8.6 | Jan 12 | Metabase channel test endpoint can reach internal local addresses |
| CVE-2025-5895 | ME Metabase Metabase | 7.5 | Jun 9 | Metabase dom.js parseDataUri redos |
| CVE-2025-32382 | ME metabase metabase | 1.8 | Apr 10 | Snowflake credentials logged by the Metabase backend |
| CVE-2025-30371 | ME metabase metabase | 2.1 | Mar 28 | Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint |
| CVE-2025-27141 | ME metabase metabase | 6.5 | Feb 24 | Metabase Enterprise Edition allows cached questions to leak data to impersonated users |
| CVE-2024-55951 | ME metabase metabase | 4.8 | Dec 16 | Metabase sandboxed users could see filter values from other sandboxed users |
| CVE-2023-37470 | ME metabase metabase | 9.8 | Aug 4 | Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint |
| CVE-2023-38646 | ME Metabase Metabase | 9.8 | Jul 21 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level |
| CVE-2023-32680 | ME metabase metabase | 9.6 | May 18 | Missing SQL permissions check in metabase |
| CVE-2023-23629 | ME Metabase Metabase | 6.3 | Jan 28 | Metabase is an open source data analytics platform |
| CVE-2023-23628 | ME Metabase Metabase | 4.1 | Jan 28 | Metabase is an open source data analytics platform |
| CVE-2022-39359 | ME metabase metabase | 6.5 | Oct 26 | Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs |
| CVE-2022-39358 | ME metabase metabase | 6.5 | Oct 26 | Metabase vulnerable to circumvention of Locked parameter in Signed Embedding |
| CVE-2022-43776 | ME Metabase Metabase | 6.5 | Oct 26 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks |
| CVE-2022-39362 | ME metabase metabase | 8.8 | Oct 26 | Metabase vulnerable to arbitrary SQL execution from queryhash |
| CVE-2022-39361 | ME metabase metabase | 8.8 | Oct 26 | Metabase vulnerable to Remote Code Execution via H2 |
| CVE-2022-39360 | ME metabase metabase | 6.5 | Oct 26 | Metabase SSO users able to circumvent IdP login by doing password reset |
| CVE-2022-24855 | ME Metabase Metabase | 5.4 | Apr 14 | Metabase is an open source business intelligence and analytics application |
| CVE-2022-24854 | ME Metabase Metabase | 8.8 | Apr 14 | Metabase is an open source business intelligence and analytics application |
| CVE-2022-24853 | ME Metabase Metabase | 5.3 | Apr 14 | Metabase is an open source business intelligence and analytics application |
| CVE-2021-41277 In wildKEV | ME metabase metabase | 7.5 | Nov 17 | GeoJSON URL validation can expose server files and environment variables to unauthorized users |
| CVE-2018-0697 | ME Metabase Metabase | 6.1 | Nov 15 | Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors |