https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:43:43.511826+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-10092 bdu:2025-10092 2026-10-03T17:43:43.621538+00:00 bdu:2025-10092 https://cve.radiocsirt.org/vuln/bit-superset-2025-55673 BIT-superset-2025-55673 — Apache Superset: Metadata exposure in embedded charts 2026-10-03T17:43:43.621574+00:00

Affected: Bitnami: superset

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.

 https://cve.radiocsirt.org/vuln/cnvd-2025-19102 cnvd-2025-19102 2026-10-03T17:43:43.621612+00:00 cnvd-2025-19102 https://cve.radiocsirt.org/vuln/euvd-2026-260036 EUVD-2026-260036 2026-10-03T17:43:43.621627+00:00 EUVD-2026-260036 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55673 fkie_cve-2025-55673 2026-10-03T17:43:43.621638+00:00

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-9g5x-mm39-wg9r GHSA-9g5x-mm39-wg9r — Apache Superset data query improperly discloses database schema information to low-privileged guest user 2026-10-03T17:43:43.621663+00:00

Affected: PyPI: apache-superset

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-1169 PYSEC-2026-1169 — Apache Superset data query improperly discloses database schema information to low-privileged guest user 2026-10-03T17:43:43.621685+00:00

Affected: PyPI: apache-superset

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1851 WID-SEC-W-2025-1851 — Apache Superset: Mehrere Schwachstellen 2026-10-03T17:43:43.621705+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.