apache-superset vulnerabilities — 137 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
5.3 medium CVE-2026-23980: Apache Superset Error-Based SQL Injection Vulnerability apache-superset PyPI 13 Jul 2026 6.0.0
7.1 high CVE-2026-23984: Apache Superset Read-Only Bypass via Improper Input Validation apache-superset PyPI 13 Jul 2026 6.0.0
5.3 medium CVE-2026-23969: Apache Superset Incomplete DISALLOWED_SQL_FUNCTIONS Default List for ClickHouse Engine apache-superset PyPI 13 Jul 2026 4.1.2
2.3 low CVE-2026-23983: Apache Superset Sensitive Data Exposure Vulnerability apache-superset PyPI 13 Jul 2026 6.0.0
7.1 high CVE-2026-23982: Apache Superset Improper Authorization Bypass for Low-Privileged Users apache-superset PyPI 13 Jul 2026 6.0.0
5.3 medium CVE-2025-55675: Apache Superset Improper Access Control Vulnerability apache-superset PyPI 07 Jul 2026 5.0.0
5.3 medium CVE-2025-55672: Apache Superset Chart Visualization Stored XSS Vulnerability apache-superset PyPI 07 Jul 2026 5.0.0
5.3 medium CVE-2025-55673: Apache Superset Data Query Exposes Database Schema to Low-Privileged Users apache-superset PyPI 07 Jul 2026 4.1.3.post1
5.3 medium CVE-2025-55674: Apache Superset SQL Function Bypass Vulnerability apache-superset PyPI 07 Jul 2026 5.0.0
7.1 high CVE-2025-48912: Apache Superset Improper Authorization Bypass via SQL Injection apache-superset PyPI 07 Jul 2026 4.1.2
8.8 high CVE-2025-27696: Apache Superset Ownership Takeover Vulnerability apache-superset PyPI 07 Jul 2026 4.1.2
6.5 medium CVE-2024-55633: Apache Superset SQLLab Improper Readonly Query Validation Vulnerability apache-superset PyPI 07 Jul 2026 4.1.0
6.5 medium CVE-2024-53949: Apache Superset Improper Authorization Allows Lower Privilege Users to Create Roles apache-superset PyPI 07 Jul 2026 4.1.0
9.8 critical CVE-2024-53947: Apache Superset SQL Injection Vulnerability Due to Improper Authorization Checks apache-superset PyPI 07 Jul 2026 4.1.0
5.3 medium CVE-2024-53948: Apache Superset Error Verbosity Exposes Metadata in Analytics Databases apache-superset PyPI 07 Jul 2026 4.1.0
4.3 medium CVE-2024-39887: Apache Superset SQL Injection Vulnerability Due to Improper Authorization apache-superset PyPI 07 Jul 2026 4.0.2
6.8 medium CVE-2024-34693: Apache Superset Arbitrary File Read Vulnerability apache-superset PyPI 07 Jul 2026 3.1.3
4.3 medium CVE-2024-28148: Apache Superset Incorrect Authorization Vulnerability apache-superset PyPI 07 Jul 2026 3.1.2
4.3 medium CVE-2024-26016: Apache Superset Improper Authorization Validation on Dashboards and Charts Import apache-superset PyPI 07 Jul 2026 3.0.4
4.9 medium CVE-2024-24773: Apache Superset SQL Statement Validation Flaw Leads to Unauthorized Data Access apache-superset PyPI 07 Jul 2026 3.0.4
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.