metabase

Top products

The 15 most recently published vulnerabilities affecting metabase.

• CVE-2026-92813Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass4.9Sep 16, 2026
• CVE-2026-86116Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API6.5Sep 5, 2026
• CVE-2026-72900Metabase information exposure6.5Aug 10, 2026
• CVE-2026-72899Metabase SQL injection via public card or dashboard10.0Aug 10, 2026
• CVE-2026-72898Metabase SQL injection via password reset endpointKEV10.0Aug 10, 2026
• CVE-2026-50147Metabase: Arbitrary File Read via MySQL Connection Property Injection7.6Jul 15, 2026
• CVE-2026-50148Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write10.0Jul 15, 2026
• CVE-2026-59826Metabase: Arbitrary Code Execution via Database Connection Detail Bypass9.1Jul 9, 2026
• CVE-2026-59827Metabase: Unsafe Deserialization of H2 Query Results9.9Jul 9, 2026
• CVE-2026-33725Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import7.2Mar 27, 2026
• CVE-2026-27464Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE7.7Feb 21, 2026
• CVE-2026-22805Metabase channel test endpoint can reach internal local addressesJan 12, 2026
• CVE-2025-5895Metabase dom.js parseDataUri redos4.3Jun 9, 2025
• CVE-2025-32382Snowflake credentials logged by the Metabase backendApr 10, 2025
• CVE-2025-30371Metabase vulnerable to circumvention of local link access protection in GeoJson endpointMar 28, 2025