Dataease - vulnerabilities (CVEs)

118 CVEs in 2 products, 6 in the last 30 days, newest from 2026-10-14.

Products

• Dataease - 89 CVEs
• Sqlbot - 15 CVEs

Newest CVEs of Dataease

• CVE-2026-102755 - CVSS 5.1 (medium), 2026-10-14: DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing…
• CVE-2026-102756 - CVSS 5.1 (medium), 2026-10-14: DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can…
• CVE-2026-104143 - CVSS 8.7 (high), 2026-10-14: DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset…
• CVE-2026-104142 - CVSS 8.7 (high), 2026-10-14: DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max,…
• CVE-2026-104141 - CVSS 8.7 (high), 2026-10-14: DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection…
• CVE-2026-108824 - CVSS 6.3 (medium), 2026-10-12: A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This…
• CVE-2026-93660 - CVSS 7.1 (high), 2026-09-18: SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify…
• CVE-2026-53557 - CVSS 7.7 (high), 2026-09-17: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted…
• CVE-2026-53555 - CVSS 5.1 (medium), 2026-09-17: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml…
• CVE-2026-53556 - CVSS 6 (medium), 2026-09-17: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in…
• CVE-2026-53554 - CVSS 7.3 (high), 2026-09-17: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in…
• CVE-2023-40772 - CVSS 4.3 (medium), 2026-09-14: A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the…
• CVE-2026-90529 - CVSS 5.1 (medium), 2026-09-13: A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file…
• CVE-2026-82879 - CVSS 6.3 (medium), 2026-08-31: DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket…
• CVE-2026-82878 - CVSS 6.3 (medium), 2026-08-31: DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints,…
• CVE-2026-45532 - CVSS 8.7 (high), 2026-08-18: DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on…
• CVE-2026-72743 - CVSS 5.4 (medium), 2026-08-10: SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE…
• CVE-2026-49867 - CVSS 6.3 (medium), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit…
• CVE-2026-46684 - CVSS 9.5 (critical), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass…
• CVE-2026-45320 - CVSS 8.7 (high), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by…
• CVE-2026-45535 - CVSS 8.7 (high), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable…
• CVE-2026-45533 - CVSS 8.3 (high), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as…
• CVE-2026-50124 - CVSS 7.1 (high), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload…
• CVE-2026-50030 - CVSS 7.1 (high), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck…
• CVE-2026-45419 - CVSS 8.5 (high), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageService#save,…
• CVE-2026-45417 - CVSS 8.7 (high), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate…
• CVE-2026-45534 - CVSS 9 (critical), 2026-07-15: DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connections can load attacker-controlled…
• CVE-2026-50530 - CVSS 7.1 (high), 2026-07-07: DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the…
• CVE-2026-50529 - CVSS 8.7 (high), 2026-07-07: DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns…
• CVE-2026-55647 - CVSS 5.1 (medium), 2026-07-07: DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html…