# Metabase CVEs > Metabase: 18 CVEs mapped to its software or packages (2 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/metabase/cves Last updated: 2026-10-13T15:44:37Z 18 CVEs map to Metabase (2 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Metabase](https://rewindex.com/company/metabase.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Metabase’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-13 | [CVE-2026-103928](https://rewindex.com/cve/CVE-2026-103928.md) | Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions | 9.3 critical | | | 2026-09-16 | [CVE-2026-92813](https://rewindex.com/cve/CVE-2026-92813.md) | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass | 4.9 medium | | | 2026-09-05 | [CVE-2026-86116](https://rewindex.com/cve/CVE-2026-86116.md) | Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API | 6.5 medium | | | 2026-08-10 | [CVE-2026-72898](https://rewindex.com/cve/CVE-2026-72898.md) | Metabase SQL injection via password reset endpoint | 10.0 critical | yes (2026-08-11) | | 2026-08-10 | [CVE-2026-72900](https://rewindex.com/cve/CVE-2026-72900.md) | Metabase information exposure | 6.5 medium | | | 2026-08-10 | [CVE-2026-72899](https://rewindex.com/cve/CVE-2026-72899.md) | Metabase SQL injection via public card or dashboard | 10.0 critical | | | 2026-07-15 | [CVE-2026-50147](https://rewindex.com/cve/CVE-2026-50147.md) | Metabase: Arbitrary File Read via MySQL Connection Property Injection | 7.6 high | | | 2026-07-15 | [CVE-2026-50148](https://rewindex.com/cve/CVE-2026-50148.md) | Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write | 10.0 critical | | | 2026-07-09 | [CVE-2026-59826](https://rewindex.com/cve/CVE-2026-59826.md) | Metabase: Arbitrary Code Execution via Database Connection Detail Bypass | 9.1 critical | | | 2026-07-09 | [CVE-2026-59827](https://rewindex.com/cve/CVE-2026-59827.md) | Metabase: Unsafe Deserialization of H2 Query Results | 9.9 critical | | | 2026-03-27 | [CVE-2026-33725](https://rewindex.com/cve/CVE-2026-33725.md) | Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import | 7.2 high | | | 2026-02-21 | [CVE-2026-27464](https://rewindex.com/cve/CVE-2026-27464.md) | Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE | 7.7 high | | | 2026-01-12 | [CVE-2026-22805](https://rewindex.com/cve/CVE-2026-22805.md) | Metabase channel test endpoint can reach internal local addresses | 8.6 high | | | 2025-04-10 | [CVE-2025-32382](https://rewindex.com/cve/CVE-2025-32382.md) | Snowflake credentials logged by the Metabase backend | 1.8 low | | | 2025-03-28 | [CVE-2025-30371](https://rewindex.com/cve/CVE-2025-30371.md) | Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint | 2.1 low | | | 2025-02-24 | [CVE-2025-27141](https://rewindex.com/cve/CVE-2025-27141.md) | Metabase Enterprise Edition allows cached questions to leak data to impersonated users | 6.5 medium | | | 2024-12-16 | [CVE-2024-55951](https://rewindex.com/cve/CVE-2024-55951.md) | Metabase sandboxed users could see filter values from other sandboxed users | 4.8 medium | | | 2021-11-17 | [CVE-2021-41277](https://rewindex.com/cve/CVE-2021-41277.md) | GeoJSON URL validation can expose server files and environment variables to unauthorized users | 10.0 critical | yes (2024-11-12) | --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Metabase) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 2 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 1 | 1 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 2 | 0 | 1 | 0 | 0 | 1 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/metabase/cves · Markdown: https://rewindex.com/company/metabase/cves.md · JSON: https://rewindex.com/api/v1/companies/metabase/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:22.067Z