dataease has 11 CVEs on record. Disclosure cadence is accelerating: 11 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 6. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-89 (4) and CWE-79 (3). Most affected products: dataease (6), SQLBot (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 11 prev 0
Worst active — by depth score
CVE-2026-104142High· 8.7DataEase is an open source data visualization and analysis tool60CVE-2026-104141High· 8.7DataEase is an open source data visualization and analysis tool60CVE-2026-53554High· 7.3SQLBot is an intelligent Text-to-SQL system based on large language models and RAG52CVE-2026-104143High· 8.7DataEase is an open source data visualization and analysis tool48CVE-2026-53556Medium· 6.0SQLBot is an intelligent Text-to-SQL system based on large language models and RAG45
dataease vulnerabilities
CVEs affecting dataease, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-104143High· 8.7DataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date co…
CVE-2026-104142High· 8.7PoCDataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-fiel…
CVE-2026-104141High· 8.7PoCDataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, includin…
CVE-2026-102756Medium· 5.1PoCDataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLi…
CVE-2026-102755Medium· 5.1PoCDataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and d…
CVE-2026-93660Medium· 6.5SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to…
CVE-2026-53557High· 7.7SQLBot is an intelligent Text-to-SQL system based on large language models and RAG
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration submitted through POST /api/v1/…
CVE-2026-53556Medium· 6.0PoCSQLBot is an intelligent Text-to-SQL system based on large language models and RAG
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled table_n…
CVE-2026-53555Medium· 5.1PoCSQLBot is an intelligent Text-to-SQL system based on large language models and RAG
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the …
CVE-2026-53554High· 7.3PoCSQLBot is an intelligent Text-to-SQL system based on large language models and RAG
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename …
CVE-2023-40772Medium· 4.3PoCA directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.
A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.