Vulnerabilities
Summary — last 7 days
New vulnerabilities4,627▼ 495 vs. last week
Critical / high1,826▼ 1,072 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)880▲ 782 vs. last week
More filters
6 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | High (8.2) | 10% | — | Dataease | 8/25/2025 | 6/17/2026 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and… | |
| Analyzed | High (8.2) | 50% | Exploit | Dataease | 6/3/2025 | 6/17/2026 | DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known… | |
| Analyzed | High (7.7) | 22% | Exploit | Dataease | 6/3/2025 | 6/17/2026 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available. | |
| Analyzed | Medium (6.8) | 10% | — | Dataease | 6/3/2025 | 6/17/2026 | DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, `getUrlType()` retrieves `hostName`. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. The… | |
| Analyzed | Critical (9.3) | 50% | Exploit | Dataease | 1/10/2025 | 6/17/2026 | DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to… | |
| Analyzed | Medium (5.3) | 16% | Exploit | Dataease | 4/8/2024 | 6/17/2026 | DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in… |