İçeriğe atla
Noroxi

metabase kayıtları

metabase üreticisine ait 26 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
2 · %7,7
Silahlaştırılmış
3 · %11,5
Pre-auth RCE
2
Düzeltme kaydı olan
%3,8
Yayından KEV’e ortanca
546 gün

Yıllara göre kayıt

  1. 18
  2. 21
  3. 22
  4. 23
  5. 25
  6. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

26 kayıt
  • CVE-2021-41277
    89Hemen

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %97

    metabase · metabase17 Kas 2021

  • CVE-2026-72898
    76Bu hafta

    Metabase SQL injection via password reset endpoint

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %19

    metabase · metabase10 Ağu 2026

  • CVE-2023-38646
    69Bu hafta

    Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    metabase · metabase21 Tem 2023

  • CVE-2023-37470
    39İzleyin

    Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint

    KritikCVSS 9,8İstismar yokEPSS %1

    metabase · metabase4 Ağu 2023

  • CVE-2023-32680
    38İzleyin

    Missing SQL permissions check in metabase

    KritikCVSS 9,6İstismar yokEPSS %1

    metabase · metabase18 May 2023

  • CVE-2026-59827
    36İzleyin

    Metabase: Unsafe Deserialization of H2 Query Results

    YüksekCVSS 8,8Kavram kanıtıEPSS %4

    metabase · metabase9 Tem 2026

  • CVE-2026-59826
    36İzleyin

    Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

    KritikCVSS 9,1İstismar yokEPSS %1

    metabase · metabase9 Tem 2026

  • CVE-2026-50148
    36İzleyin

    Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

    KritikCVSS 9,1İstismar yokEPSS %1

    metabase · metabase15 Tem 2026

  • CVE-2022-39361
    35İzleyin

    Metabase vulnerable to Remote Code Execution via H2

    YüksekCVSS 8,8İstismar yokEPSS %1

    metabase · metabase26 Eki 2022

  • CVE-2022-24854
    35İzleyin

    Database bypassing any permissions in Metabase via SQlite attach

    YüksekCVSS 8,8İstismar yokEPSS %1

    metabase · metabase14 Nis 2022

  • CVE-2022-39362
    35İzleyin

    Metabase vulnerable to arbitrary SQL execution from queryhash

    YüksekCVSS 8,8İstismar yokEPSS %1

    metabase · metabase26 Eki 2022

  • CVE-2026-50147
    30İzleyin

    Metabase: Arbitrary File Read via MySQL Connection Property Injection

    YüksekCVSS 7,6İstismar yokEPSS %0

    metabase · metabase15 Tem 2026

  • CVE-2026-33725
    28İzleyin

    Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    metabase · metabase26 Mar 2026

  • CVE-2022-43776
    26İzleyin

    The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks.

    OrtaCVSS 6,5İstismar yokEPSS %1

    metabase · metabase26 Eki 2022

  • CVE-2022-39359
    26İzleyin

    Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

    OrtaCVSS 6,5İstismar yokEPSS %1

    metabase · metabase26 Eki 2022

  • CVE-2022-39360
    26İzleyin

    Metabase SSO users able to circumvent IdP login by doing password reset

    OrtaCVSS 6,5İstismar yokEPSS %1

    metabase · metabase26 Eki 2022

  • CVE-2022-39358
    26İzleyin

    Metabase vulnerable to circumvention of Locked parameter in Signed Embedding

    OrtaCVSS 6,5İstismar yokEPSS %0

    metabase · metabase26 Eki 2022

  • CVE-2026-27464
    26İzleyin

    Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE

    OrtaCVSS 6,5İstismar yokEPSS %0

    metabase · metabase21 Şub 2026

  • CVE-2023-23629
    25İzleyin

    Metabase subject to Improper Privilege Management

    OrtaCVSS 6,3İstismar yokEPSS %0

    metabase · metabase27 Oca 2023

  • CVE-2018-0697
    24İzleyin

    Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via

    OrtaCVSS 6,1İstismar yokEPSS %1

    metabase · metabase15 Kas 2018

  • CVE-2022-24853
    22İzleyin

    File system exposure in Metabase

    OrtaCVSS 5,3Kavram kanıtıEPSS %3

    metabase · metabase14 Nis 2022

  • CVE-2022-24855
    21İzleyin

    XSS vulnerability in Metabase

    OrtaCVSS 5,4İstismar yokEPSS %1

    metabase · metabase14 Nis 2022

  • CVE-2025-27141
    19İzleyin

    Metabase Enterprise Edition allows cached questions to leak data to impersonated users

    OrtaCVSS 4,8İstismar yokEPSS %0

    metabase · metabase24 Şub 2025

  • CVE-2023-23628
    16İzleyin

    Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor

    OrtaCVSS 4,1İstismar yokEPSS %0

    metabase · metabase27 Oca 2023

  • CVE-2025-5895
    8İzleyin

    Metabase dom.js parseDataUri redos

    DüşükCVSS 2,1İstismar yokEPSS %1

    metabase · metabase9 Haz 2025