https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T14:40:48.537172+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-55673 CVE-2025-55673 — Apache Superset: Metadata exposure in embedded charts 2026-10-04T14:40:48.684155+00:00

Affected: Apache Software Foundation Apache Superset

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-9g5x-mm39-wg9r GHSA-9g5x-mm39-wg9r — Apache Superset data query improperly discloses database schema information to low-privileged guest user 2026-10-04T14:40:48.684223+00:00

Affected: PyPI: apache-superset

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.