Lightdash
7 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Lightdash, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.
Lightdash CVEs per month
| Month | CVEs |
|---|---|
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 1 |
| 2026-09 | 0 |
| 2026-10 | 3 |
Severity
How the 7 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High2
- Medium3
Latest CVEs
The 7 most recently published vulnerabilities affecting Lightdash.
- CVE-2026-61654Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key—
- CVE-2026-61576Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key—
- CVE-2026-108747Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion4.2
- CVE-2026-72846Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery6.4
- CVE-2024-6586Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a thr...7.3
- CVE-2024-6585Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actor...5.4
- CVE-2023-35844packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.7.5
Product grouping is registry-driven, with AI assist and human review. How it works