Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,466All CVEsplus 19,159 rejected
- 640Last 24 hours4,914 in the last 7 days
- 18,832Last 30 days1,596 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 5 | 1 | 1 | 0 | 13 | 30 |
| 2025 | 0 | 0 | 1 | 2 | 0 | 3 | 17 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 14 |
| 2023 | 1 | 0 | 3 | 0 | 0 | 4 | 13 |
| 2022 | 0 | 4 | 4 | 0 | 0 | 8 | 9 |
| 2021 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-103928 | Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functionsmetabase · metabase | Critical9.3 |
| CVE-2026-92813 | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypassPublic exploitmetabase · Metabase | Medium6.9 |
| CVE-2026-86116 | Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management APIPublic exploitmetabase · metabase | High7.1 |
| CVE-2026-72900 | Metabase information exposureMetabase · Metabase | High7.1 |
| CVE-2026-72899 | Metabase SQL injection via public card or dashboardMetabase · Metabase | Critical10.0 |
| CVE-2026-72898 | Metabase SQL injection via password reset endpointExploitedPublic exploitMetabase · Metabase | Critical10.0 |
| CVE-2026-50147 | Metabase: Arbitrary File Read via MySQL Connection Property Injectionmetabase · metabase | High7.6 |
| CVE-2026-50148 | Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Writemetabase · metabase | Critical10.0 |
| CVE-2026-59826 | Metabase: Arbitrary Code Execution via Database Connection Detail Bypassmetabase · metabase | Critical9.1 |
| CVE-2026-59827 | Metabase: Unsafe Deserialization of H2 Query ResultsPublic exploitmetabase · metabase | Critical9.9 |
| CVE-2026-33725 | Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Importmetabase · metabase | High7.2 |
| CVE-2026-27464 | Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCEmetabase · metabase | High7.7 |
| CVE-2026-22805 | Metabase channel test endpoint can reach internal local addressesmetabase · metabase | Low2.1 |
| CVE-2025-32382 | Snowflake credentials logged by the Metabase backendmetabase · metabase | Low1.8 |
| CVE-2025-30371 | Metabase vulnerable to circumvention of local link access protection in GeoJson endpointmetabase · metabase | Low2.1 |
| CVE-2025-27141 | Metabase Enterprise Edition allows cached questions to leak data to impersonated usersmetabase · metabase | Medium4.8 |
| CVE-2024-55951 | Metabase sandboxed users could see filter values from other sandboxed usersmetabase · metabase | Medium4.8 |
| CVE-2023-37470 | Metabase vulnerable to remote code execution via POST /api/setup/validate API endpointmetabase · metabase | Critical10.0 |
| CVE-2023-32680 | Missing SQL permissions check in metabasemetabase · metabase | Medium5.8 |
| CVE-2023-23629 | Metabase subject to Improper Privilege Managementmetabase · metabase | Medium6.3 |
| CVE-2023-23628 | Metabase subject to Exposure of Sensitive Information to an Unauthorized Actormetabase · metabase | Medium5.7 |
| CVE-2022-39362 | Metabase vulnerable to arbitrary SQL execution from queryhashmetabase · metabase | High8.8 |
| CVE-2022-39361 | Metabase vulnerable to Remote Code Execution via H2metabase · metabase | High8.8 |
| CVE-2022-39360 | Metabase SSO users able to circumvent IdP login by doing password resetmetabase · metabase | Medium6.5 |
| CVE-2022-39359 | Metabase's GeoJSON validation doesn't prevent redirects to blocked URLsmetabase · metabase | Medium6.5 |
| CVE-2022-39358 | Metabase vulnerable to circumvention of Locked parameter in Signed Embeddingmetabase · metabase | Medium6.5 |
| CVE-2022-24853 | File system exposure in MetabasePublic exploitmetabase · metabase | Medium5.9 |
| CVE-2022-24854 | Database bypassing any permissions in Metabase via SQlite attachmetabase · metabase | High8.0 |
| CVE-2022-24855 | XSS vulnerability in Metabasemetabase · metabase | High8.7 |
| CVE-2021-41277 | GeoJSON URL validation can expose server files and environment variables to unauthorized usersExploitedPublic exploitmetabase · metabase | Critical10.0 |