# Apache Superset


- [CVE-2023-27524](https://insights.sbomify.com/CVE-2023-27524/): Apache Superset Insecure Default Initialization of Resource (high 8.9, exploited in the wild)
- [CVE-2022-27479](https://insights.sbomify.com/CVE-2022-27479/): SQL injection vulnerability in chart data API (critical 9.8)
- [CVE-2018-8021](https://insights.sbomify.com/CVE-2018-8021/): Deserialization of Untrusted Data in superset (critical 9.8)
- [CVE-2023-49657](https://insights.sbomify.com/CVE-2023-49657/): Apache Superset: Stored XSS in Dashboard Title and Chart Title (critical 9.6)
- [CVE-2022-43719](https://insights.sbomify.com/CVE-2022-43719/): Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API (high 8.8)
- [CVE-2021-41971](https://insights.sbomify.com/CVE-2021-41971/): Possible SQL Injection when template processing is enabled (high 8.8)
- [CVE-2020-13948](https://insights.sbomify.com/CVE-2020-13948/): Apache Superset OS Command Injection (high 8.8)
- [CVE-2020-13952](https://insights.sbomify.com/CVE-2020-13952/): Plaintext password leak in Apache Superset (high 8.1)
- [CVE-2023-49734](https://insights.sbomify.com/CVE-2023-49734/): Apache Superset: Privilege Escalation Vulnerability (high 7.7)
- [CVE-2024-53949](https://insights.sbomify.com/CVE-2024-53949/): Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled (high 7.6)
- [CVE-2026-23982](https://insights.sbomify.com/CVE-2026-23982/): Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass (high 7.1)
- [CVE-2026-23984](https://insights.sbomify.com/CVE-2026-23984/): Apache Superset: SQLLab Read-Only Bypass on PostgreSQL (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/superset/