https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T13:37:24.722663+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-superset-2026-23969 BIT-superset-2026-23969 — Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering 2026-10-10T13:37:24.726854+00:00

Affected: Bitnami: superset

Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

 https://cve.radiocsirt.org/vuln/cnvd-2026-13250 cnvd-2026-13250 2026-10-10T13:37:24.726908+00:00 cnvd-2026-13250 https://cve.radiocsirt.org/vuln/euvd-2026-270432 EUVD-2026-270432 2026-10-10T13:37:24.726926+00:00 EUVD-2026-270432 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23969 fkie_cve-2026-23969 2026-10-10T13:37:24.726938+00:00

Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-48m2-v2r8-h23m GHSA-48m2-v2r8-h23m — Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine 2026-10-10T13:37:24.726961+00:00

Affected: PyPI: apache-superset

Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-2373 PYSEC-2026-2373 — Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine 2026-10-10T13:37:24.726984+00:00

Affected: PyPI: apache-superset

Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete.

This issue affects Apache Superset: before 4.1.2.

Users are recommended to upgrade to version 4.1.2, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0502 WID-SEC-W-2026-0502 — Apache Superset: Mehrere Schwachstellen 2026-10-10T13:37:24.727004+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.