# dataease.

Every CVE that names dataease among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-102755.md)
  `CVE-2026-102755` · CVE record: dataease dataease · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-102756.md)
  `CVE-2026-102756` · CVE record: dataease dataease · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DataEase: Stored SQL Injection via dateFormat field templates](https://agentprime.io/advisories/CVE-2026-104143.md)
  `CVE-2026-104143` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-289
- [DataEase: Stored SQL Injection in group-field binning bounds](https://agentprime.io/advisories/CVE-2026-104142.md)
  `CVE-2026-104142` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [DataEase: SQL Injection in datasource metadata identifiers](https://agentprime.io/advisories/CVE-2026-104141.md)
  `CVE-2026-104141` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [DataEase Utils.java Utils.buildCalcField sql injection](https://agentprime.io/advisories/CVE-2026-108824.md)
  `CVE-2026-108824` · CVE record: DataEase · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, SQL injection
- [Path traversal in DataEase](https://agentprime.io/advisories/CVE-2023-40772.md)
  `CVE-2023-40772` · CVE record: DataEase DataEase · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting](https://agentprime.io/advisories/CVE-2026-90529.md)
  `CVE-2026-90529` · CVE record: DataEase · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [DataEase before 2.10.26 Access Control Bypass via Share Tickets](https://agentprime.io/advisories/CVE-2026-82879.md)
  `CVE-2026-82879` · CVE record: dataease dataease · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints](https://agentprime.io/advisories/CVE-2026-82878.md)
  `CVE-2026-82878` · CVE record: dataease dataease · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [DataEase has a Path Traversal Vulnerability](https://agentprime.io/advisories/CVE-2026-45532.md)
  `CVE-2026-45532` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Path traversal
- [DataEase: Authenticated Stored XSS in DataEase Template Static Resources](https://agentprime.io/advisories/CVE-2026-49867.md)
  `CVE-2026-49867` · CVE record: dataease dataease · CVSS 6.3 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Cross-site scripting (XSS)
- [DataEase: Unauthorized Command Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-46684.md)
  `CVE-2026-46684` · CVE record: dataease dataease · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Weak cryptography or TLS
- [DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection](https://agentprime.io/advisories/CVE-2026-45320.md)
  `CVE-2026-45320` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: SQL injection
- [DataEase: Stored SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-45535.md)
  `CVE-2026-45535` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: SQL injection
- [DataEase: Path Traversal Vulnerability](https://agentprime.io/advisories/CVE-2026-45533.md)
  `CVE-2026-45533` · CVE record: dataease dataease · CVSS 8.3 High · Not analysed yet · Published 15 Jul 2026 · Tags: Path traversal
- [DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper](https://agentprime.io/advisories/CVE-2026-50124.md)
  `CVE-2026-50124` · CVE record: dataease dataease · CVSS 7.1 High · Not analysed yet · Published 15 Jul 2026 · Tags: Unrestricted file upload
- [DataEase: Arbitrary SQL execution in preview path (direct data disclosure)](https://agentprime.io/advisories/CVE-2026-50030.md)
  `CVE-2026-50030` · CVE record: dataease dataease · CVSS 7.1 High · Not analysed yet · Published 15 Jul 2026 · Tags: SQL injection
- [DataEase: Arbitrary File Write Vulnerability](https://agentprime.io/advisories/CVE-2026-45419.md)
  `CVE-2026-45419` · CVE record: dataease dataease · CVSS 8.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Path traversal
- [DataEase: SQL injection vulnerability](https://agentprime.io/advisories/CVE-2026-45417.md)
  `CVE-2026-45417` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: SQL injection
- [DataEase: RCE Vulnerability](https://agentprime.io/advisories/CVE-2026-45534.md)
  `CVE-2026-45534` · CVE record: dataease dataease · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Code injection
- [DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets](https://agentprime.io/advisories/CVE-2026-50530.md)
  `CVE-2026-50530` · CVE record: dataease dataease · CVSS 7.1 High · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [DataEase: Link Token Leakage Prior to Share Password/Ticket Validation](https://agentprime.io/advisories/CVE-2026-50529.md)
  `CVE-2026-50529` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [DataEase: authenticated stored XSS in the dashboard text components](https://agentprime.io/advisories/CVE-2026-55647.md)
  `CVE-2026-55647` · CVE record: dataease dataease · CVSS 5.1 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site scripting (XSS)
- [DataEase: Authenticated SQL Injection in Chart Quota Filters](https://agentprime.io/advisories/CVE-2026-55635.md)
  `CVE-2026-55635` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: SQL injection
- [DataEase: Hardcoded JWT Signing Secret in ShareLink](https://agentprime.io/advisories/CVE-2026-57172.md)
  `CVE-2026-57172` · CVE record: dataease dataease · CVSS 8.3 High · Not analysed yet · Published 7 Jul 2026 · Tags: Hard-coded credentials
- [DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-53751.md)
  `CVE-2026-53751` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Code injection
- [DataEase: Unauthorized Access to Engine Database via previewSql Endpoint](https://agentprime.io/advisories/CVE-2026-53730.md)
  `CVE-2026-53730` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass](https://agentprime.io/advisories/CVE-2026-55633.md)
  `CVE-2026-55633` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Unrestricted file upload
- [DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management](https://agentprime.io/advisories/CVE-2026-55631.md)
  `CVE-2026-55631` · CVE record: dataease dataease · CVSS 7.2 High · Not analysed yet · Published 7 Jul 2026 · Tags: Path traversal
- [DataEase ExportCenter IDOR allows cross-user export task access](https://agentprime.io/advisories/CVE-2026-53729.md)
  `CVE-2026-53729` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection](https://agentprime.io/advisories/CVE-2026-8724.md)
  `CVE-2026-8724` · CVE record: Dataease · CVSS 5.1 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, SQL injection
- [DataEase: Quartz Deserialization → Remote Code Execution](https://agentprime.io/advisories/CVE-2026-40901.md)
  `CVE-2026-40901` · CVE record: dataease dataease · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: Insecure deserialization
- [DataEase has SQL Injection via Stacked Queries](https://agentprime.io/advisories/CVE-2026-40900.md)
  `CVE-2026-40900` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has an Arbitrary File Read Vulnerability](https://agentprime.io/advisories/CVE-2026-40899.md)
  `CVE-2026-40899` · CVE record: dataease dataease · CVSS 8.3 High · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-183
- [DataEase SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-33207.md)
  `CVE-2026-33207` · CVE record: dataease dataease · CVSS 8.6 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection via Datasource Management](https://agentprime.io/advisories/CVE-2026-33122.md)
  `CVE-2026-33122` · CVE record: dataease dataease · CVSS 8.6 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection via Datasource Save Flow](https://agentprime.io/advisories/CVE-2026-33121.md)
  `CVE-2026-33121` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection through its getFieldEnumObj Endpoint](https://agentprime.io/advisories/CVE-2026-33084.md)
  `CVE-2026-33084` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase has SQL Injection in Order By Clause](https://agentprime.io/advisories/CVE-2026-33083.md)
  `CVE-2026-33083` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase: SQL Injection in v2 Dataset Export](https://agentprime.io/advisories/CVE-2026-33082.md)
  `CVE-2026-33082` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: SQL injection
- [DataEase is Vulnerable to H2 JDBC RCE Bypass](https://agentprime.io/advisories/CVE-2026-32939.md)
  `CVE-2026-32939` · CVE record: dataease dataease · CVSS 7.7 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-178
- [Dataease: Redshift JDBC RCE Bypass](https://agentprime.io/advisories/CVE-2026-32140.md)
  `CVE-2026-32140` · CVE record: dataease dataease · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Mar 2026 · Tags: Path traversal
- [Dataease: Unfiltered active SVG content leads to Stored XSS](https://agentprime.io/advisories/CVE-2026-32139.md)
  `CVE-2026-32139` · CVE record: dataease dataease · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Cross-site scripting (XSS)
- [DataEase SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-32137.md)
  `CVE-2026-32137` · CVE record: dataease dataease · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Mar 2026 · Tags: SQL injection
- [DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover](https://agentprime.io/advisories/CVE-2026-23958.md)
  `CVE-2026-23958` · CVE record: dataease dataease · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Hard-coded credentials
- [DataEase DB2 JNDI Vulnerability](https://agentprime.io/advisories/CVE-2025-64428.md)
  `CVE-2025-64428` · CVE record: dataease dataease · CVSS 8.9 High · Not analysed yet · Published 20 Nov 2025 · Tags: Other injection
- [DataEase is vulnerable to Oracle JNDI Injection](https://agentprime.io/advisories/CVE-2025-64164.md)
  `CVE-2025-64164` · CVE record: dataease dataease · CVSS 8.9 High · Not analysed yet · Published 6 Nov 2025 · Tags: Insecure deserialization
- [DataEase's DB2 is vulnerable to SSRF](https://agentprime.io/advisories/CVE-2025-64163.md)
  `CVE-2025-64163` · CVE record: dataease dataease · CVSS 8.9 High · Not analysed yet · Published 5 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration](https://agentprime.io/advisories/CVE-2025-62419.md)
  `CVE-2025-62419` · CVE record: dataease dataease · CVSS 8.2 High · Not analysed yet · Published 17 Oct 2025 · Tags: Insecure deserialization
- [DataEase vulnerable to remote code execution via H2 JDBC driver bypass](https://agentprime.io/advisories/CVE-2025-62420.md)
  `CVE-2025-62420` · CVE record: dataease dataease · CVSS 8.2 High · Not analysed yet · Published 17 Oct 2025 · Tags: Insecure deserialization
- [DataEase vulnerable to stored cross-site scripting via file upload bypass](https://agentprime.io/advisories/CVE-2025-62421.md)
  `CVE-2025-62421` · CVE record: dataease dataease · CVSS 5.5 Medium · Not analysed yet · Published 17 Oct 2025 · Tags: Cross-site scripting (XSS)
- [DataEase SQL injection vulnerability](https://agentprime.io/advisories/CVE-2025-62422.md)
  `CVE-2025-62422` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2025 · Tags: SQL injection
- [Dataease H2 data source JDBC URL validation bypass leads to remote code execution](https://agentprime.io/advisories/CVE-2025-58748.md)
  `CVE-2025-58748` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2025 · Tags: Insecure deserialization
- [Dataease has a JDBC attack vulnerability in the Impala datasource](https://agentprime.io/advisories/CVE-2025-58046.md)
  `CVE-2025-58046` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2025 · Tags: Other injection, Insecure deserialization
- [Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter](https://agentprime.io/advisories/CVE-2025-58045.md)
  `CVE-2025-58045` · CVE record: dataease dataease · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2025 · Tags: Server-side request forgery (SSRF)
- [Dataease H2 JDBC RCE Bypass](https://agentprime.io/advisories/CVE-2025-57772.md)
  `CVE-2025-57772` · CVE record: dataease dataease · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 25 Aug 2025 · Tags: Code injection
- [Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability](https://agentprime.io/advisories/CVE-2025-57773.md)
  `CVE-2025-57773` · CVE record: dataease dataease · CVSS 8.2 High · Not analysed yet · Published 25 Aug 2025 · Tags: Code injection, Insecure deserialization
- [Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-53006.md)
  `CVE-2025-53006` · CVE record: dataease dataease · CVSS 8.9 High · Not analysed yet · Published 2 Jul 2025 · Tags: CWE-153
- [Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-53005.md)
  `CVE-2025-53005` · CVE record: dataease dataease · CVSS 8.9 High · Not analysed yet · Published 1 Jul 2025 · Tags: CWE-153

Older: <https://agentprime.io/advisories/technology/dataease.md?cursor=WyIyMDI1LTA3LTAxVDAwOjMzOjUzLjk2MzAwMFoiLCJDVkUtMjAyNS01MzAwNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=dataease>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/dataease/>. Everything for agents: <https://agentprime.io/llms.txt>.