https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 16:10:42 +0000 https://cve.radiocsirt.org/vuln/bit-superset-2026-23983 <p><strong>Affected:</strong> Bitnami: superset</p> <p>A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data</p> <p>This issue affects Apache Superset: before 6.0.0.</p> <p>Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)</p> <p><strong>Affected:</strong> Bitnami: superset</p> <p>A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data</p> <p>This issue affects Apache Superset: before 6.0.0.</p> <p>Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)</p> https://cve.radiocsirt.org/vuln/bit-superset-2026-23983 https://cve.radiocsirt.org/vuln/cnvd-2026-13251 cnvd-2026-13251 https://cve.radiocsirt.org/vuln/cnvd-2026-13251 https://cve.radiocsirt.org/vuln/euvd-2026-270435 EUVD-2026-270435 https://cve.radiocsirt.org/vuln/euvd-2026-270435 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23983 <p>A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data</p> <p>This issue affects Apache Superset: before 6.0.0.</p> <p>Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)</p> <p>A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data</p> <p>This issue affects Apache Superset: before 6.0.0.</p> <p>Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23983 https://cve.radiocsirt.org/vuln/ghsa-h294-8fxm-m2pj <p><strong>Affected:</strong> PyPI: apache-superset</p> <p>A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data</p> <p>This issue affects Apache Superset: before 6.0.0.</p> <p>Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)</p> <p><strong>Affected:</strong> PyPI: apache-superset</p> <p>A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data</p> <p>This issue affects Apache Superset: before 6.0.0.</p> <p>Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)</p> https://cve.radiocsirt.org/vuln/ghsa-h294-8fxm-m2pj https://cve.radiocsirt.org/vuln/pysec-2026-2375 <p><strong>Affected:</strong> PyPI: apache-superset</p> <p>A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data</p> <p>This issue affects Apache Superset: before 6.0.0.</p> <p>Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)</p> <p><strong>Affected:</strong> PyPI: apache-superset</p> <p>A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data</p> <p>This issue affects Apache Superset: before 6.0.0.</p> <p>Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)</p> https://cve.radiocsirt.org/vuln/pysec-2026-2375 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0502 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0502