M
Vendor security profile2 actively exploited CVEs
metabase
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs12
Critical7
CISA KEV2
Public exploit6
Patch rate%42
Avg. CVSS8.7
12-month vulnerability rate
0
0
0
0
0
0
0
0
4
3
2
1
CVE KEV
CVE severity distribution
12toplam CVE
Critical7 (58%)
High3 (25%)
Medium2 (17%)
Patch and exploitation view
%42
Verified patch
%17
CISA KEV
%50
Public exploit
5Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
9.3
CVE-2026-103928
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
M
Patch status unknown
6.9
CVE-2026-92813
Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
M
Patch status unknownEPSS %0
7.1
CVE-2026-86116
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
M
Patch verifiedEPSS %0
6.5
CVE-2026-72900
Metabase information exposure
M
Patch status unknownEPSS %0
10.0
CVE-2026-72899
Metabase SQL injection via public card or dashboard
M
Patch status unknownEPSS %1
10.0
CVE-2026-72898 Actively exploited
Metabase SQL injection via password reset endpoint
M
Patch verifiedEPSS %19
9.1
CVE-2026-50148
Vulnerability in Metabase
M
Patch status unknownEPSS %1
7.6
CVE-2026-50147
Vulnerability in Metabase
M
Patch status unknownEPSS %0
8.8
CVE-2026-59827
Deserialization of untrusted data in Metabase
M
Patch verifiedEPSS %4
9.1
CVE-2026-59826
Code injection in Metabase
M
Patch verifiedEPSS %1