metabase metabase

Name: metabase metabase
Brand: metabase

productUS

cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

4critical7high11medium0low

updated 2026-10-27

vulnerabilities (26)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-72898US	—OT critical	98.6% (100th)	KEV	0.63.5	2026-08-10	12 versions
CVE-2021-41277US	high7.5OT critical	97.2% (100th)	KEV	no fix	2021-11-17	10 versions
CVE-2023-38646US	critical9.8	99.5% (100th)	Exploit	0.44.7.1	2023-07-21	8 versions
CVE-2026-59827US	high8.8	3.79% (90th)	Exploit	1.59.12	2026-07-09	8 versions
CVE-2022-24853US	medium5.3	2.52% (85th)	Exploit	1.42.4	2022-04-14	6 versions
CVE-2026-33725US	—	0.79% (56th)	Exploit	1.55.22	2026-03-27	6 versions
CVE-2023-37470US	critical9.8	1.35% (71st)	—	0.46.6.4	2023-08-04	8 versions
CVE-2022-39361US	high8.8	1.25% (69th)	—	1.41.9	2022-10-26	8 versions
CVE-2022-24854US	high8.8	1.05% (64th)	—	1.41.7	2022-04-14	4 versions
CVE-2022-39362US	high8.8	1.02% (63rd)	—	1.42.6	2022-10-26	8 versions
CVE-2026-59826US	—	1.01% (63rd)	—	1.59.12	2026-07-09	4 versions
CVE-2018-0697US	medium6.1	0.84% (58th)	—	no fix	2018-11-15	≤ 0.29.3
CVE-2022-43776US	medium6.5	0.79% (56th)	—	0.44.5	2022-10-26	< 0.44.5
CVE-2026-50148US	critical9.1	0.77% (55th)	—	1.56.25	2026-07-15	7 versions
CVE-2022-39359US	medium6.5	0.73% (54th)	—	1.42.6	2022-10-26	8 versions
CVE-2022-24855US	medium5.4	0.71% (53rd)	—	1.42.4	2022-04-14	6 versions
CVE-2025-5895US	high7.5	0.63% (50th)	—	no fix	2025-06-09	= 0.54.10
CVE-2022-39360US	medium6.5	0.61% (49th)	—	0.42.6	2022-10-26	8 versions
CVE-2023-32680US	critical9.6OT elevated	0.60% (48th)	—	0.45.4	2023-05-18	6 versions
CVE-2022-39358US	medium6.5	0.54% (45th)	—	0.43.7	2022-10-26	6 versions
CVE-2023-23628US	medium4.1	0.44% (38th)	—	0.44.6.1	2023-01-28	6 versions
CVE-2023-23629US	medium6.3	0.38% (32nd)	—	1.43.7.1	2023-01-28	6 versions
CVE-2025-27141US	medium6.5	0.36% (30th)	—	1.51.14	2025-02-24	4 versions
CVE-2026-50147US	—	0.34% (27th)	—	1.57.19.1	2026-07-15	4 versions
CVE-2026-27464US	medium6.5	0.30% (22nd)	—	0.57.13	2026-02-21	4 versions
CVE-2026-22805US	high8.6	0.24% (15th)	—	0.56.3	2026-01-12	6 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')3 CVEs
CWE-287Improper Authentication2 CVEs
CWE-502Deserialization of Untrusted Data2 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-1333Inefficient Regular Expression Complexity1 CVEs
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE26 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan