Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

metabase Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-86116`Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API	Exploitation statusPublic exploit	FixYes	Affected productmetabase	Published09/05/2026	SeverityHigh
`CVE-2026-72900`Metabase information exposure	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published08/10/2026	SeverityHigh
`CVE-2026-72899`Metabase SQL injection via public card or dashboard	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published08/10/2026	SeverityCritical
`CVE-2026-72898`Metabase SQL injection via password reset endpoint	Exploitation statusKEV	FixYes	Affected productmetabase	Published08/10/2026	SeverityCritical
`CVE-2026-50147`Metabase: Arbitrary File Read via MySQL Connection Property Injection	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published07/15/2026	SeverityHigh
`CVE-2026-50148`Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published07/15/2026	SeverityCritical
`CVE-2026-59826`Metabase: Arbitrary Code Execution via Database Connection Detail Bypass	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published07/09/2026	SeverityCritical
`CVE-2026-59827`Metabase: Unsafe Deserialization of H2 Query Results	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published07/09/2026	SeverityCritical
`CVE-2026-33725`Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import	Exploitation statusNot known exploited	FixNot confirmed	Affected productmetabase	Published03/27/2026	SeverityHigh
`CVE-2026-27464`Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published02/21/2026	SeverityHigh
`CVE-2026-22805`Metabase channel test endpoint can reach internal local addresses	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published01/12/2026	SeverityLow
`CVE-2025-5895`Metabase dom.js parseDataUri redos	Exploitation statusPublic exploit	FixYes	Affected productMetabase	Published06/09/2025	SeverityMedium
`CVE-2025-32382`Snowflake credentials logged by the Metabase backend	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published04/10/2025	SeverityLow
`CVE-2025-30371`Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published03/28/2025	SeverityLow
`CVE-2025-27141`Metabase Enterprise Edition allows cached questions to leak data to impersonated users	Exploitation statusNot known exploited	FixNot confirmed	Affected productmetabase	Published02/24/2025	SeverityMedium
`CVE-2024-55951`Metabase sandboxed users could see filter values from other sandboxed users	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published12/16/2024	SeverityMedium
`CVE-2023-37470`Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint	Exploitation statusNot known exploited	FixNot confirmed	Affected productmetabase	Published08/04/2023	SeverityCritical
`CVE-2023-38646`CVE-2023-38646	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published07/21/2023	SeverityUnknown
`CVE-2023-32680`Missing SQL permissions check in metabase	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published05/18/2023	SeverityMedium
`CVE-2023-23629`Metabase subject to Improper Privilege Management	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published01/28/2023	SeverityMedium
`CVE-2023-23628`Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published01/28/2023	SeverityMedium
`CVE-2022-39361`Metabase vulnerable to Remote Code Execution via H2	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published10/26/2022	SeverityHigh
`CVE-2022-39362`Metabase vulnerable to arbitrary SQL execution from queryhash	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published10/26/2022	SeverityHigh
`CVE-2022-39360`Metabase SSO users able to circumvent IdP login by doing password reset	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published10/26/2022	SeverityMedium
`CVE-2022-39359`Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published10/26/2022	SeverityMedium
`CVE-2022-43776`CVE-2022-43776	Exploitation statusNot known exploited	FixNot confirmed	Affected productMetabase	Published10/26/2022	SeverityMedium
`CVE-2022-39358`Metabase vulnerable to circumvention of Locked parameter in Signed Embedding	Exploitation statusNot known exploited	FixYes	Affected productmetabase	Published10/26/2022	SeverityMedium
`CVE-2022-24853`File system exposure in Metabase	Exploitation statusPublic exploit	FixNot confirmed	Affected productmetabase	Published04/14/2022	SeverityMedium
`CVE-2022-24854`Database bypassing any permissions in Metabase via SQlite attach	Exploitation statusNot known exploited	FixNot confirmed	Affected productmetabase	Published04/14/2022	SeverityHigh
`CVE-2022-24855`XSS vulnerability in Metabase	Exploitation statusNot known exploited	FixNot confirmed	Affected productmetabase	Published04/14/2022	SeverityHigh
`CVE-2021-41277`GeoJSON URL validation can expose server files and environment variables to unauthorized users	Exploitation statusKEV	FixYes	Affected productmetabase	Published11/17/2021	SeverityCritical
`CVE-2018-0697`CVE-2018-0697	Exploitation statusNot confirmed	FixNot confirmed	Affected productMetabase	Published11/15/2018	SeverityUnknown

32 / 32 Results

All vulnerabilities loaded

Security vulnerabilities from metabase

metabase

Verify to analyze this security profile

How many security vulnerabilities does metabase have?

Which metabase product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular metabase products

metabase