Início / CVEs
Vulnerabilidades exploradas (CISA KEV)
CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.
CVE-2026-72898
Crítica · 10.0
KEV Urgente · 73 Exploit público CWE-89 10/08/2026
Metabase SQL Injection Vulnerability
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
CVE-2021-41277
Alta · 7.5
KEV Alta · 69 Exploit público CWE-200 17/11/2021
Metabase GeoJSON API Local File Inclusion Vulnerability
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.