Advisories · Technology

dataease.

Every CVE that names dataease among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-102755 CVE record

CVSS 5.1 Medium

DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting
- dataease
- Cross-site scripting (XSS)
Not analysed yet 14 Oct 2026
CVE-2026-102756 CVE record

CVSS 5.1 Medium

DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting
- dataease
- Cross-site scripting (XSS)
Not analysed yet 14 Oct 2026
CVE-2026-104143 CVE record

CVSS 8.7 High

DataEase: Stored SQL Injection via dateFormat field templates
- dataease
- CWE-289
Not analysed yet 14 Oct 2026
CVE-2026-104142 CVE record

CVSS 8.7 High

DataEase: Stored SQL Injection in group-field binning bounds
- dataease
- SQL injection
Not analysed yet 14 Oct 2026
CVE-2026-104141 CVE record

CVSS 8.7 High

DataEase: SQL Injection in datasource metadata identifiers
- dataease
- SQL injection
Not analysed yet 14 Oct 2026
CVE-2026-108824 CVE record

CVSS 5.3 Medium

DataEase Utils.java Utils.buildCalcField sql injection
- DataEase
- Other injection
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2023-40772 CVE record

CVSS 4.3 Medium

Path traversal in DataEase
- DataEase
- Path traversal
Not analysed yet 14 Sept 2026
CVE-2026-90529 CVE record

CVSS 5.1 Medium

DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting
- DataEase
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 13 Sept 2026
CVE-2026-82879 CVE record

CVSS 5.3 Medium

DataEase before 2.10.26 Access Control Bypass via Share Tickets
- dataease
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-82878 CVE record

CVSS 5.3 Medium

DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
- dataease
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-45532 CVE record

CVSS 8.7 High

DataEase has a Path Traversal Vulnerability
- dataease
- Path traversal
Not analysed yet 18 Aug 2026
CVE-2026-49867 CVE record

CVSS 6.3 Medium

DataEase: Authenticated Stored XSS in DataEase Template Static Resources
- dataease
- Cross-site scripting (XSS)
Not analysed yet 15 Jul 2026
CVE-2026-46684 CVE record

CVSS 9.5 CriticalCritical · CVSS 9+

DataEase: Unauthorized Command Execution Vulnerability
- dataease
- Weak cryptography or TLS
Not analysed yet 15 Jul 2026
CVE-2026-45320 CVE record

CVSS 8.7 High

DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
- dataease
- SQL injection
Not analysed yet 15 Jul 2026
CVE-2026-45535 CVE record

CVSS 8.7 High

DataEase: Stored SQL Injection Vulnerability
- dataease
- SQL injection
Not analysed yet 15 Jul 2026
CVE-2026-45533 CVE record

CVSS 8.3 High

DataEase: Path Traversal Vulnerability
- dataease
- Path traversal
Not analysed yet 15 Jul 2026
CVE-2026-50124 CVE record

CVSS 7.1 High

DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
- dataease
- Unrestricted file upload
Not analysed yet 15 Jul 2026
CVE-2026-50030 CVE record

CVSS 7.1 High

DataEase: Arbitrary SQL execution in preview path (direct data disclosure)
- dataease
- SQL injection
Not analysed yet 15 Jul 2026
CVE-2026-45419 CVE record

CVSS 8.5 High

DataEase: Arbitrary File Write Vulnerability
- dataease
- Path traversal
Not analysed yet 15 Jul 2026
CVE-2026-45417 CVE record

CVSS 8.7 High

DataEase: SQL injection vulnerability
- dataease
- SQL injection
Not analysed yet 15 Jul 2026
CVE-2026-45534 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

DataEase: RCE Vulnerability
- dataease
- Code injection
Not analysed yet 15 Jul 2026
CVE-2026-50530 CVE record

CVSS 7.1 High

DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets
- dataease
- Broken access control
Not analysed yet 7 Jul 2026
CVE-2026-50529 CVE record

CVSS 8.7 High

DataEase: Link Token Leakage Prior to Share Password/Ticket Validation
- dataease
- Broken access control
Not analysed yet 7 Jul 2026
CVE-2026-55647 CVE record

CVSS 5.1 Medium

DataEase: authenticated stored XSS in the dashboard text components
- dataease
- Cross-site scripting (XSS)
Not analysed yet 7 Jul 2026
CVE-2026-55635 CVE record

CVSS 8.7 High

DataEase: Authenticated SQL Injection in Chart Quota Filters
- dataease
- SQL injection
Not analysed yet 7 Jul 2026
CVE-2026-57172 CVE record

CVSS 8.3 High

DataEase: Hardcoded JWT Signing Secret in ShareLink
- dataease
- Hard-coded credentials
Not analysed yet 7 Jul 2026
CVE-2026-53751 CVE record

CVSS 8.7 High

DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)
- dataease
- Code injection
Not analysed yet 7 Jul 2026
CVE-2026-53730 CVE record

CVSS 8.7 High

DataEase: Unauthorized Access to Engine Database via previewSql Endpoint
- dataease
- Broken access control
Not analysed yet 7 Jul 2026
CVE-2026-55633 CVE record

CVSS 8.7 High

DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass
- dataease
- Unrestricted file upload
Not analysed yet 7 Jul 2026
CVE-2026-55631 CVE record

CVSS 7.2 High

DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management
- dataease
- Path traversal
Not analysed yet 7 Jul 2026
CVE-2026-53729 CVE record

CVSS 8.7 High

DataEase ExportCenter IDOR allows cross-user export task access
- dataease
- Broken access control
Not analysed yet 7 Jul 2026
CVE-2026-8724 CVE record

CVSS 5.1 Medium

Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection
- Dataease
- Other injection
- SQL injection
Not analysed yet 17 May 2026
CVE-2026-40901 CVE record

CVSS 7.5 High

DataEase: Quartz Deserialization → Remote Code Execution
- dataease
- Insecure deserialization
Not analysed yet 16 Apr 2026
CVE-2026-40900 CVE record

CVSS 8.7 High

DataEase has SQL Injection via Stacked Queries
- dataease
- SQL injection
Not analysed yet 16 Apr 2026
CVE-2026-40899 CVE record

CVSS 8.3 High

DataEase has an Arbitrary File Read Vulnerability
- dataease
- CWE-183
Not analysed yet 16 Apr 2026
CVE-2026-33207 CVE record

CVSS 8.6 High

DataEase SQL Injection Vulnerability
- dataease
- SQL injection
Not analysed yet 16 Apr 2026
CVE-2026-33122 CVE record

CVSS 8.6 High

DataEase has SQL Injection via Datasource Management
- dataease
- SQL injection
Not analysed yet 16 Apr 2026
CVE-2026-33121 CVE record

CVSS 8.7 High

DataEase has SQL Injection via Datasource Save Flow
- dataease
- SQL injection
Not analysed yet 16 Apr 2026
CVE-2026-33084 CVE record

CVSS 8.7 High

DataEase has SQL Injection through its getFieldEnumObj Endpoint
- dataease
- SQL injection
Not analysed yet 16 Apr 2026
CVE-2026-33083 CVE record

CVSS 8.7 High

DataEase has SQL Injection in Order By Clause
- dataease
- SQL injection
Not analysed yet 16 Apr 2026
CVE-2026-33082 CVE record

CVSS 8.7 High

DataEase: SQL Injection in v2 Dataset Export
- dataease
- SQL injection
Not analysed yet 16 Apr 2026
CVE-2026-32939 CVE record

CVSS 7.7 High

DataEase is Vulnerable to H2 JDBC RCE Bypass
- dataease
- CWE-178
Not analysed yet 20 Mar 2026
CVE-2026-32140 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Dataease: Redshift JDBC RCE Bypass
- dataease
- Path traversal
Not analysed yet 12 Mar 2026
CVE-2026-32139 CVE record

CVSS 5.3 Medium

Dataease: Unfiltered active SVG content leads to Stored XSS
- dataease
- Cross-site scripting (XSS)
Not analysed yet 12 Mar 2026
CVE-2026-32137 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

DataEase SQL Injection Vulnerability
- dataease
- SQL injection
Not analysed yet 12 Mar 2026
CVE-2026-23958 CVE record

CVSS 8.8 High

DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
- dataease
- Hard-coded credentials
Not analysed yet 22 Jan 2026
CVE-2025-64428 CVE record

CVSS 8.9 High

DataEase DB2 JNDI Vulnerability
- dataease
- Other injection
Not analysed yet 20 Nov 2025
CVE-2025-64164 CVE record

CVSS 8.9 High

DataEase is vulnerable to Oracle JNDI Injection
- dataease
- Insecure deserialization
Not analysed yet 6 Nov 2025
CVE-2025-64163 CVE record

CVSS 8.9 High

DataEase's DB2 is vulnerable to SSRF
- dataease
- Server-side request forgery (SSRF)
Not analysed yet 5 Nov 2025
CVE-2025-62419 CVE record

CVSS 8.2 High

DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration
- dataease
- Insecure deserialization
Not analysed yet 17 Oct 2025
CVE-2025-62420 CVE record

CVSS 8.2 High

DataEase vulnerable to remote code execution via H2 JDBC driver bypass
- dataease
- Insecure deserialization
Not analysed yet 17 Oct 2025
CVE-2025-62421 CVE record

CVSS 5.5 Medium

DataEase vulnerable to stored cross-site scripting via file upload bypass
- dataease
- Cross-site scripting (XSS)
Not analysed yet 17 Oct 2025
CVE-2025-62422 CVE record

CVSS 8.7 High

DataEase SQL injection vulnerability
- dataease
- SQL injection
Not analysed yet 17 Oct 2025
CVE-2025-58748 CVE record

CVSS 8.7 High

Dataease H2 data source JDBC URL validation bypass leads to remote code execution
- dataease
- Insecure deserialization
Not analysed yet 15 Sept 2025
CVE-2025-58046 CVE record

CVSS 8.7 High

Dataease has a JDBC attack vulnerability in the Impala datasource
- dataease
- Other injection
- Insecure deserialization
Not analysed yet 15 Sept 2025
CVE-2025-58045 CVE record

CVSS 7.1 High

Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter
- dataease
- Server-side request forgery (SSRF)
Not analysed yet 15 Sept 2025
CVE-2025-57772 CVE record

CVSS 8.2 HighCritical · CVSS 7+ and EPSS

Dataease H2 JDBC RCE Bypass
- dataease
- Code injection
Not analysed yet 25 Aug 2025
CVE-2025-57773 CVE record

CVSS 8.2 High

Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability
- dataease
- Code injection
- Insecure deserialization
Not analysed yet 25 Aug 2025
CVE-2025-53006 CVE record

CVSS 8.9 High

Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability
- dataease
- CWE-153
Not analysed yet 2 Jul 2025
CVE-2025-53005 CVE record

CVSS 8.9 High

Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability
- dataease
- CWE-153
Not analysed yet 1 Jul 2025