CVE Tools
Track your stack

Metabase

9 CVEs tracked since 2022. Since Apr 2022, none of them reached CISA KEV.

Metabase CVEs per month

Apr 2022 to Oct 2022. Point at a month, or focus the strip and use the arrow keys.
Metabase CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2022-0430
2022-05null or fewer
2022-06null or fewer
2022-07null or fewer
2022-08null or fewer
2022-09null or fewer
2022-1060

Products

The products that kept showing up in Metabase's monthly top three, with their CVEs summed over those months.

  1. Metabase92 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Metabase.

  1. CVE-2026-92813Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass4.9
  2. CVE-2026-86116Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API6.5
  3. CVE-2026-72900Metabase information exposure6.5
  4. CVE-2026-72899Metabase SQL injection via public card or dashboard10.0
  5. CVE-2026-72898Metabase SQL injection via password reset endpoint10.0
  6. CVE-2026-50147Metabase: Arbitrary File Read via MySQL Connection Property Injection7.6
  7. CVE-2026-50148Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write10.0
  8. CVE-2026-59826Metabase: Arbitrary Code Execution via Database Connection Detail Bypass9.1
  9. CVE-2026-59827Metabase: Unsafe Deserialization of H2 Query Results9.9
  10. CVE-2026-33725Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import7.2
  11. CVE-2026-27464Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE7.7
  12. CVE-2026-22805Metabase channel test endpoint can reach internal local addresses—
  13. CVE-2025-5895Metabase dom.js parseDataUri redos4.3
  14. CVE-2025-32382Snowflake credentials logged by the Metabase backend—
  15. CVE-2025-30371Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint—

The record

Peak rank
#106 in Oct 2022
Busiest month shown
Oct 2022, 6 CVEs
Months with a KEV entry
0 since Apr 2022
Monthly snapshots
2 since 2022
Metabase's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store