Vulnerabilities

TI-2025-35106 CVE-2025-55675 · GHSA-mhpq-m962-mg92

Apache Superset: Incorrect datasource authorization on REST API

LOW 25

Apache Superset contains an improper access control vulnerability in its /explore endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00648 Published 2025-08-14 Fixed in 5.0.0 CWE-285

TI-2025-35105 CVE-2025-55674 · GHSA-fxgf-3xh6-m2pp

LOW 25

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0075 Published 2025-08-14 Fixed in 5.0.0 CWE-89

TI-2025-35103 CVE-2025-55672 · GHSA-fj97-2v9x-w5m4

LOW 25

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00801 Published 2025-08-14 Fixed in 5.0.0 CWE-80