agentprime: metabaseEvery new CVE for metabase.https://agentprime.io/CVE-2026-103928: Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functionshttps://agentprime.io/advisories/CVE-2026-103928/https://agentprime.io/advisories/CVE-2026-103928/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 15:44:37 GMTCVEcriticalCVE-2026-92813: Metabase through 0.63.18 SSRF via GeoJSON URL validation bypasshttps://agentprime.io/advisories/CVE-2026-92813/https://agentprime.io/advisories/CVE-2026-92813/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 20:32:58 GMTCVECVE-2026-86116: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management APIhttps://agentprime.io/advisories/CVE-2026-86116/https://agentprime.io/advisories/CVE-2026-86116/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 09:59:06 GMTCVECVE-2026-72900: Metabase information exposurehttps://agentprime.io/advisories/CVE-2026-72900/https://agentprime.io/advisories/CVE-2026-72900/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:56:23 GMTCVECVE-2026-72899: Metabase SQL injection via public card or dashboardhttps://agentprime.io/advisories/CVE-2026-72899/https://agentprime.io/advisories/CVE-2026-72899/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:56:09 GMTCVEcriticalCVE-2026-72898: Metabase SQL injection via password reset endpointhttps://agentprime.io/advisories/CVE-2026-72898/https://agentprime.io/advisories/CVE-2026-72898/CVSS 10.0 (Critical). Critical: In CISA’s KEV catalogue since 11 Aug 2026: it is known to be exploited. CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.99 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 17:55:54 GMTCVEcriticalKEVCVE-2026-50147: Metabase: Arbitrary File Read via MySQL Connection Property Injectionhttps://agentprime.io/advisories/CVE-2026-50147/https://agentprime.io/advisories/CVE-2026-50147/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 15:21:23 GMTCVECVE-2026-50148: Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Writehttps://agentprime.io/advisories/CVE-2026-50148/https://agentprime.io/advisories/CVE-2026-50148/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 15:18:04 GMTCVEcriticalCVE-2026-59826: Metabase: Arbitrary Code Execution via Database Connection Detail Bypasshttps://agentprime.io/advisories/CVE-2026-59826/https://agentprime.io/advisories/CVE-2026-59826/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 17:46:36 GMTCVEcriticalCVE-2026-59827: Metabase: Unsafe Deserialization of H2 Query Resultshttps://agentprime.io/advisories/CVE-2026-59827/https://agentprime.io/advisories/CVE-2026-59827/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 17:43:57 GMTCVEcriticalCVE-2026-33725: Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Importhttps://agentprime.io/advisories/CVE-2026-33725/https://agentprime.io/advisories/CVE-2026-33725/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Mar 2026 00:19:39 GMTCVECVE-2026-27464: Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCEhttps://agentprime.io/advisories/CVE-2026-27464/https://agentprime.io/advisories/CVE-2026-27464/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 21 Feb 2026 07:57:50 GMTCVECVE-2026-22805: Metabase channel test endpoint can reach internal local addresseshttps://agentprime.io/advisories/CVE-2026-22805/https://agentprime.io/advisories/CVE-2026-22805/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Jan 2026 22:36:35 GMTCVECVE-2025-5895: Metabase dom.js parseDataUri redoshttps://agentprime.io/advisories/CVE-2025-5895/https://agentprime.io/advisories/CVE-2025-5895/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Jun 2025 20:00:19 GMTCVECVE-2025-32382: Snowflake credentials logged by the Metabase backendhttps://agentprime.io/advisories/CVE-2025-32382/https://agentprime.io/advisories/CVE-2025-32382/CVSS 1.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Apr 2025 14:40:53 GMTCVECVE-2025-30371: Metabase vulnerable to circumvention of local link access protection in GeoJson endpointhttps://agentprime.io/advisories/CVE-2025-30371/https://agentprime.io/advisories/CVE-2025-30371/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Mar 2025 14:47:36 GMTCVECVE-2025-27141: Metabase Enterprise Edition allows cached questions to leak data to impersonated usershttps://agentprime.io/advisories/CVE-2025-27141/https://agentprime.io/advisories/CVE-2025-27141/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Feb 2025 22:05:14 GMTCVECVE-2024-55951: Metabase sandboxed users could see filter values from other sandboxed usershttps://agentprime.io/advisories/CVE-2024-55951/https://agentprime.io/advisories/CVE-2024-55951/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Dec 2024 20:03:54 GMTCVECVE-2023-37470: Metabase vulnerable to remote code execution via POST /api/setup/validate API endpointhttps://agentprime.io/advisories/CVE-2023-37470/https://agentprime.io/advisories/CVE-2023-37470/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Aug 2023 15:12:43 GMTCVEcriticalCVE-2023-32680: Missing SQL permissions check in metabasehttps://agentprime.io/advisories/CVE-2023-32680/https://agentprime.io/advisories/CVE-2023-32680/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 May 2023 22:55:30 GMTCVECVE-2023-23629: Metabase subject to Improper Privilege Managementhttps://agentprime.io/advisories/CVE-2023-23629/https://agentprime.io/advisories/CVE-2023-23629/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 28 Jan 2023 01:23:33 GMTCVECVE-2023-23628: Metabase subject to Exposure of Sensitive Information to an Unauthorized Actorhttps://agentprime.io/advisories/CVE-2023-23628/https://agentprime.io/advisories/CVE-2023-23628/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 28 Jan 2023 01:11:16 GMTCVECVE-2022-43776: Server-side request forgery in Metabasehttps://agentprime.io/advisories/CVE-2022-43776/https://agentprime.io/advisories/CVE-2022-43776/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Oct 2022 00:00:00 GMTCVECVE-2022-39362: Metabase vulnerable to arbitrary SQL execution from queryhashhttps://agentprime.io/advisories/CVE-2022-39362/https://agentprime.io/advisories/CVE-2022-39362/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Oct 2022 00:00:00 GMTCVECVE-2022-39361: Metabase vulnerable to Remote Code Execution via H2https://agentprime.io/advisories/CVE-2022-39361/https://agentprime.io/advisories/CVE-2022-39361/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Oct 2022 00:00:00 GMTCVECVE-2022-39360: Metabase SSO users able to circumvent IdP login by doing password resethttps://agentprime.io/advisories/CVE-2022-39360/https://agentprime.io/advisories/CVE-2022-39360/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Oct 2022 00:00:00 GMTCVECVE-2022-39359: Metabase's GeoJSON validation doesn't prevent redirects to blocked URLshttps://agentprime.io/advisories/CVE-2022-39359/https://agentprime.io/advisories/CVE-2022-39359/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Oct 2022 00:00:00 GMTCVECVE-2022-39358: Metabase vulnerable to circumvention of Locked parameter in Signed Embeddinghttps://agentprime.io/advisories/CVE-2022-39358/https://agentprime.io/advisories/CVE-2022-39358/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Oct 2022 00:00:00 GMTCVECVE-2022-24853: File system exposure in Metabasehttps://agentprime.io/advisories/CVE-2022-24853/https://agentprime.io/advisories/CVE-2022-24853/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 14 Apr 2022 21:45:16 GMTCVECVE-2022-24854: Database bypassing any permissions in Metabase via SQlite attachhttps://agentprime.io/advisories/CVE-2022-24854/https://agentprime.io/advisories/CVE-2022-24854/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 14 Apr 2022 21:40:11 GMTCVECVE-2022-24855: XSS vulnerability in Metabasehttps://agentprime.io/advisories/CVE-2022-24855/https://agentprime.io/advisories/CVE-2022-24855/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 14 Apr 2022 21:35:11 GMTCVECVE-2021-41277: GeoJSON URL validation can expose server files and environment variables to unauthorized usershttps://agentprime.io/advisories/CVE-2021-41277/https://agentprime.io/advisories/CVE-2021-41277/CVSS 10.0 (Critical). Critical: In CISA’s KEV catalogue since 12 Nov 2024: it is known to be exploited. CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.97 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Nov 2021 20:05:11 GMTCVEcriticalKEVCVE-2018-0697: Metabase: Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote…https://agentprime.io/advisories/CVE-2018-0697/https://agentprime.io/advisories/CVE-2018-0697/Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Nov 2018 15:00:00 GMTCVE