MEDIUMPyPI
GHSA-gvxg-9hqx-f4rg· BIT-superset-2026-23980, CVE-2026-23980Apache Superset allows privileged users to conduct error-based SQL Injection
Modified: 7/13/2026
package
PyPI/apache-superset
pkg:pypi/apache-superset
LOWPyPI
GHSA-h294-8fxm-m2pj· BIT-superset-2026-23983, CVE-2026-23983Apache Superset allows authenticated users to view sensitive data without explicit permissions
Modified: 7/13/2026
MEDIUM4.3PyPI
GHSA-h7r6-8qmm-hj5r· BIT-superset-2024-27315, CVE-2024-27315Apache Superset: Improper error handling on alerts
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-hc74-9vjm-c9xv· BIT-superset-2023-42502, CVE-2023-42502Apache Superset Open Redirect vulnerability
Modified: 7/7/2026
MEDIUM6.8PyPI
GHSA-hcr7-cqwc-q5gq· BIT-superset-2024-34693, CVE-2024-34693Apache Superset server arbitrary file read
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-hhm3-48h2-597v· BIT-superset-2021-44451, CVE-2021-44451Insufficiently Protected Credentials in Apache Superset
Modified: 2/5/2025
MEDIUM4.3PyPI
GHSA-299q-3p96-5898· BIT-superset-2024-28148, CVE-2024-28148Apache Superset Incorrect Authorization vulnerability
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-2cx9-54hp-r698· BIT-superset-2024-53948, CVE-2024-53948Apache Superset: Error verbosity exposes metadata in analytics databases
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-2q6j-vpvr-6pvj· BIT-superset-2024-39887, CVE-2024-39887Apache Superset vulnerable to improper SQL authorization
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-35fc-9hrj-3585· BIT-superset-2024-53949, CVE-2024-53949Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-3hp7-4qq4-v5c6· BIT-superset-2023-42504, CVE-2023-42504Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
Modified: 7/7/2026
HIGHPyPI
GHSA-3m2g-v7jf-7fxc· BIT-superset-2026-23982, CVE-2026-23982Apache Superset Improper Authorization allows low-privileged users to bypass access controls
Modified: 7/13/2026
MEDIUM4.3PyPI
GHSA-3v9r-885j-762g· BIT-superset-2024-26016, CVE-2024-26016Apache Superset: Improper authorization validation on dashboards and charts import
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-42q4-9xf9-f67x· BIT-superset-2021-41972, CVE-2021-41972Apache Superset allowed for database connections password leak for authenticated users
Modified: 2/5/2025
MEDIUMPyPI
GHSA-48m2-v2r8-h23m· BIT-superset-2026-23969, CVE-2026-23969Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Modified: 7/13/2026
MEDIUM4.3PyPI
GHSA-4fg9-5w46-xmrj· BIT-superset-2023-36388, CVE-2023-36388Apache Superset Server Side Request Forgery vulnerability
Modified: 7/7/2026
MEDIUM4.9PyPI
GHSA-5474-f7g5-273q· BIT-superset-2024-24773, CVE-2024-24773Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Modified: 7/7/2026
HIGH8.9PyPI
GHSA-5cx2-vq3h-x52c· BIT-superset-2023-27524, CVE-2023-27524Apache superset missing check for default SECRET_KEY
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-5fp8-c45m-256p· BIT-superset-2021-42250, CVE-2021-42250Improper Encoding or Escaping of Output in Apache Superset
Modified: 2/5/2025
HIGH8.8PyPI
GHSA-7222-r37x-8q3m· BIT-superset-2022-43719, CVE-2022-43719Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-748r-5r8q-273m· BIT-superset-2021-37839, CVE-2021-37839Apache Superset allows authenticated users to access metadata they have no permission to
Modified: 7/7/2026
HIGH8.1PyPI
GHSA-77pw-c3j2-5fc8· BIT-superset-2020-13952, CVE-2020-13952Plaintext password leak in Apache Superset
Modified: 2/5/2025
MEDIUM6.5PyPI
GHSA-787v-v9vq-4rgv· BIT-superset-2024-55633, CVE-2024-55633Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-79x5-cv79-49rj· BIT-superset-2022-43718, CVE-2022-43718Apache Superset is vulnerable to Cross-Site Scripting (XSS)
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-7jhg-8m74-6f6g· BIT-superset-2023-27525, CVE-2023-27525Apache Superset vulnerable to Improper Authorization
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-8f5j-mgx9-5hm5· BIT-superset-2022-45438, CVE-2022-45438Apache Superset has Improper Access Control
Modified: 7/7/2026
HIGHPyPI
GHSA-8w7f-8pr9-xgwj· BIT-superset-2025-48912, CVE-2025-48912Apache Superset: Improper authorization bypass on row level security via SQL Injection
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-92qf-8gh3-gwcm· BIT-superset-2024-53947, CVE-2024-53947Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-95ch-p3gw-23qg· BIT-superset-2023-32672, CVE-2023-32672Apache Superset has incorrect authorization check
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-95mg-jgfx-54v9· BIT-superset-2023-46104, CVE-2023-46104Apache Superset uncontrolled resource consumption
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-9832-mgg4-3gr6· BIT-superset-2023-36387, CVE-2023-36387Apache Superset has improper default REST API permission for Gamma users
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-9c29-9h4m-wg5p· CVE-2019-12414, PYSEC-2019-173Users can view database names in Apache Superset
Modified: 9/5/2024
MEDIUM5.4PyPI
GHSA-9f88-wg5r-947j· BIT-superset-2022-43717, CVE-2022-43717Apache Superset vulnerable to Cross-site Scripting
Modified: 7/7/2026
MEDIUMPyPI
GHSA-9g5x-mm39-wg9r· BIT-superset-2025-55673, CVE-2025-55673Apache Superset data query improperly discloses database schema information to low-privileged guest user
Modified: 8/13/2026
MEDIUM4.3PyPI
GHSA-9qc3-p9jq-2x27· BIT-superset-2023-27526, CVE-2023-27526Apache Superset users may incorrectly create resources using the import charts feature
Modified: 7/7/2026
HIGH8.8PyPI
GHSA-cj7g-h7rf-h8j9· BIT-superset-2020-13948, CVE-2020-13948Apache Superset OS Command Injection
Modified: 2/5/2025
MEDIUM6.5PyPI
GHSA-cmjc-52fg-9f7j· BIT-superset-2023-30776, CVE-2023-30776Apache Superset vulnerable to Exposure of Sensitive Information
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-cpvx-2365-466c· BIT-superset-2023-39264, CVE-2023-39264Apache Superset may expose internal traces on REST API endpoints
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-cxvp-3frm-3876· BIT-superset-2022-41703, CVE-2022-41703Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
Modified: 7/7/2026
HIGH7.3PyPI
GHSA-f678-j579-4xf5· BIT-superset-2023-40610, CVE-2023-40610Apache Superset - Elevation of Privilege
Modified: 7/8/2026
MEDIUM5.4PyPI
GHSA-f8vc-f28w-x9c9· BIT-superset-2021-32609, CVE-2021-32609Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page
Modified: 2/5/2025
MEDIUM5.4PyPI
GHSA-fcg4-pm6h-9xx2· BIT-superset-2022-43721, CVE-2022-43721Apache Superset Open Redirect vulnerability
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-fgpw-4w69-j256· BIT-superset-2023-42505, CVE-2023-42505Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Modified: 7/7/2026
MEDIUM6.6PyPI
GHSA-fj4x-m62j-wvwg· BIT-superset-2023-37941, CVE-2023-37941Apache Superset Deserialization of Untrusted Data vulnerability
Modified: 7/7/2026
MEDIUMPyPI
GHSA-fj97-2v9x-w5m4· BIT-superset-2025-55672, CVE-2025-55672Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-fm4q-j8g4-c9j4· BIT-superset-2023-39265, CVE-2023-39265Apache Superset Improper Input Validation vulnerability
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-fpmr-qmgh-42x2· BIT-superset-2022-43720, CVE-2022-43720Apache Superset vulnerable to Injection
Modified: 7/7/2026
MEDIUMPyPI
GHSA-fxgf-3xh6-m2pp· BIT-superset-2025-55674, CVE-2025-55674Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-fxjg-28fm-pfxh· BIT-superset-2023-25504, CVE-2023-25504Apache Superset Server-Side Request Forgery vulnerability
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-fxjm-wvj9-9c39· BIT-superset-2020-1932, CVE-2020-1932Information disclosure in Apache Superset
Modified: 2/5/2025
HIGH7.7PyPI
GHSA-g49j-j489-3xpf· BIT-superset-2023-49734, CVE-2023-49734Apache Superset incorrect write permissions vulnerability
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-jfxj-xf67-x723· BIT-superset-2023-49736, CVE-2023-49736Apache Superset SQL injection vulnerability
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-m6jm-3v38-76j4· BIT-superset-2024-24772, CVE-2024-24772Apache Superset: Improper Neutralization of custom SQL on embedded context
Modified: 7/7/2026
MEDIUMPyPI
GHSA-mhpq-m962-mg92· BIT-superset-2025-55675, CVE-2025-55675Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Modified: 9/10/2026
HIGHPyPI
GHSA-mwf2-qr4v-94h2· BIT-superset-2026-23984, CVE-2026-23984Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
Modified: 7/13/2026
MEDIUM5.3PyPI
GHSA-p5w7-qmq6-pmjr· CVE-2019-12413, PYSEC-2019-172Users able to query database metadata in Apache Superset
Modified: 9/5/2024
MEDIUM6.1PyPI
GHSA-pfwg-rxf4-97c3· BIT-superset-2021-28125, CVE-2021-28125Open Redirect in Apache Superset
Modified: 7/13/2026
HIGH8.8PyPI
GHSA-pg8m-4p8j-2p56· BIT-superset-2021-41971, CVE-2021-41971Apache Superset SQL Injection when template processing is enabled
Modified: 2/5/2025
CRITICAL9.6PyPI
GHSA-rwhh-6x83-84v6· BIT-superset-2023-49657, CVE-2023-49657Cross-site Scripting in Apache superset
Modified: 6/29/2026
MEDIUM5.0PyPI
GHSA-v594-2c97-hx38· BIT-superset-2023-27523, CVE-2023-27523Apache Superset vulnerable to improper data authorization
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-vv65-fjfj-4736· BIT-superset-2023-42501, CVE-2023-42501Apache Superset has Incorrect Default Permissions
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-w358-rj93-r5qv· BIT-superset-2021-27907, CVE-2021-27907Apache Superset Stored XSS on Dashboard markdown
Modified: 2/5/2025
HIGH8.8PyPI
GHSA-w6c7-j32f-rq8j· BIT-superset-2025-27696, CVE-2025-27696Apache Superset Allows Ownership Takeover
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-wh73-hpcg-v32j· BIT-superset-2022-27479, CVE-2022-27479SQL injection in apache-superset
Modified: 2/5/2025
MEDIUM4.3PyPI
GHSA-wq8q-99p5-xfrw· BIT-superset-2023-43701, CVE-2023-43701Apache Superset Cross-site Scripting vulnerability
Modified: 7/7/2026
MEDIUM5.0PyPI
GHSA-wr6g-9wcr-cmqj· BIT-superset-2024-24779, CVE-2024-24779Apache Superset: Improper data authorization when creating a new dataset
Modified: 7/7/2026
—PyPI
PYSEC-2019-172· CVE-2019-12413, GHSA-p5w7-qmq6-pmjrModified: 11/8/2023
—PyPI
PYSEC-2019-173· CVE-2019-12414, GHSA-9c29-9h4m-wg5pModified: 11/8/2023
—PyPI
PYSEC-2020-222· BIT-superset-2020-13948, CVE-2020-13948Modified: 6/10/2026
—PyPI
PYSEC-2020-223· BIT-superset-2020-13952, CVE-2020-13952Modified: 2/5/2025
—PyPI
PYSEC-2020-224· BIT-superset-2020-1932, CVE-2020-1932Modified: 2/5/2025
—PyPI
PYSEC-2021-127· BIT-superset-2021-27907, CVE-2021-27907Modified: 2/5/2025
—PyPI
PYSEC-2021-128· BIT-superset-2021-28125, CVE-2021-28125Modified: 7/13/2026
—PyPI
PYSEC-2021-377· BIT-superset-2021-32609, CVE-2021-32609Modified: 2/5/2025
—PyPI
PYSEC-2021-378· BIT-superset-2021-41971, CVE-2021-41971Modified: 2/5/2025
—PyPI
PYSEC-2021-434· BIT-superset-2021-41972, CVE-2021-41972Modified: 2/5/2025
—PyPI
PYSEC-2021-435· BIT-superset-2021-42250, CVE-2021-42250Modified: 2/5/2025
—PyPI
PYSEC-2026-2372· BIT-superset-2026-23982, CVE-2026-23982Apache Superset Improper Authorization allows low-privileged users to bypass access controls
Modified: 7/13/2026
—PyPI
PYSEC-2026-2373· BIT-superset-2026-23969, CVE-2026-23969Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Modified: 7/13/2026
—PyPI
PYSEC-2026-2374· BIT-superset-2026-23980, CVE-2026-23980Apache Superset allows privileged users to conduct error-based SQL Injection
Modified: 7/13/2026
—PyPI
PYSEC-2026-2375· BIT-superset-2026-23983, CVE-2026-23983Apache Superset allows authenticated users to view sensitive data without explicit permissions
Modified: 7/13/2026
—PyPI
PYSEC-2026-2376· BIT-superset-2026-23984, CVE-2026-23984Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
Modified: 7/13/2026
—PyPI
PYSEC-2022-188· BIT-superset-2022-27479, CVE-2022-27479Modified: 2/5/2025
—PyPI
PYSEC-2022-36· BIT-superset-2021-44451, CVE-2021-44451Modified: 2/5/2025
MEDIUM4.3PyPI
PYSEC-2026-1153· BIT-superset-2024-28148, CVE-2024-28148Apache Superset Incorrect Authorization vulnerability
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1154· BIT-superset-2024-53948, CVE-2024-53948Apache Superset: Error verbosity exposes metadata in analytics databases
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-1155· BIT-superset-2024-39887, CVE-2024-39887Apache Superset vulnerable to improper SQL authorization
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1156· BIT-superset-2024-53949, CVE-2024-53949Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1157· BIT-superset-2023-42504, CVE-2023-42504Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-1158· BIT-superset-2024-26016, CVE-2024-26016Apache Superset: Improper authorization validation on dashboards and charts import
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-1159· BIT-superset-2023-36388, CVE-2023-36388Apache Superset Server Side Request Forgery vulnerability
Modified: 7/7/2026
MEDIUM4.9PyPI
PYSEC-2026-1160· BIT-superset-2024-24773, CVE-2024-24773Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Modified: 7/7/2026
HIGH8.9PyPI
PYSEC-2026-1161· BIT-superset-2023-27524, CVE-2023-27524Apache superset missing check for default SECRET_KEY
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1162· BIT-superset-2024-55633, CVE-2024-55633Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-1163· BIT-superset-2023-27525, CVE-2023-27525Apache Superset vulnerable to Improper Authorization
Modified: 7/7/2026
—PyPI
PYSEC-2026-1164· BIT-superset-2025-48912, CVE-2025-48912Apache Superset: Improper authorization bypass on row level security via SQL Injection
Modified: 7/7/2026
CRITICAL9.8PyPI
PYSEC-2026-1165· BIT-superset-2024-53947, CVE-2024-53947Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-1166· BIT-superset-2023-32672, CVE-2023-32672Apache Superset has incorrect authorization check
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1167· BIT-superset-2023-46104, CVE-2023-46104Apache Superset uncontrolled resource consumption
Modified: 7/7/2026
MEDIUM5.4PyPI
PYSEC-2026-1168· BIT-superset-2023-36387, CVE-2023-36387Apache Superset has improper default REST API permission for Gamma users
Modified: 7/7/2026