https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T16:10:43.150526+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-superset-2026-23983 BIT-superset-2026-23983 — Apache Superset: Sensitive Data Exposure via REST API (disabled by default) 2026-10-10T16:10:43.154563+00:00

Affected: Bitnami: superset

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)

 https://cve.radiocsirt.org/vuln/cnvd-2026-13251 cnvd-2026-13251 2026-10-10T16:10:43.154623+00:00 cnvd-2026-13251 https://cve.radiocsirt.org/vuln/euvd-2026-270435 EUVD-2026-270435 2026-10-10T16:10:43.154641+00:00 EUVD-2026-270435 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23983 fkie_cve-2026-23983 2026-10-10T16:10:43.154653+00:00

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)

 https://cve.radiocsirt.org/vuln/ghsa-h294-8fxm-m2pj GHSA-h294-8fxm-m2pj — Apache Superset allows authenticated users to view sensitive data without explicit permissions 2026-10-10T16:10:43.154680+00:00

Affected: PyPI: apache-superset

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)

 https://cve.radiocsirt.org/vuln/pysec-2026-2375 PYSEC-2026-2375 — Apache Superset allows authenticated users to view sensitive data without explicit permissions 2026-10-10T16:10:43.154706+00:00

Affected: PyPI: apache-superset

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0502 WID-SEC-W-2026-0502 — Apache Superset: Mehrere Schwachstellen 2026-10-10T16:10:43.154730+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.