https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:10:29.292651+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-10090 bdu:2025-10090 2026-10-03T20:10:29.393302+00:00 bdu:2025-10090 https://cve.radiocsirt.org/vuln/bit-superset-2025-55674 BIT-superset-2025-55674 — Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions 2026-10-03T20:10:29.393361+00:00

Affected: Bitnami: superset

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/cnvd-2025-19100 cnvd-2025-19100 2026-10-03T20:10:29.393401+00:00 cnvd-2025-19100 https://cve.radiocsirt.org/vuln/euvd-2026-260037 EUVD-2026-260037 2026-10-03T20:10:29.393416+00:00 EUVD-2026-260037 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55674 fkie_cve-2025-55674 2026-10-03T20:10:29.393428+00:00

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-fxgf-3xh6-m2pp GHSA-fxgf-3xh6-m2pp — Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions 2026-10-03T20:10:29.393452+00:00

Affected: PyPI: apache-superset

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-1178 PYSEC-2026-1178 — Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions 2026-10-03T20:10:29.393476+00:00

Affected: PyPI: apache-superset

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1851 WID-SEC-W-2025-1851 — Apache Superset: Mehrere Schwachstellen 2026-10-03T20:10:29.393498+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.