Vulnerabilities
Summary — last 7 days
New vulnerabilities4,627▼ 495 vs. last week
Critical / high1,826▼ 1,072 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)880▲ 782 vs. last week
More filters
7 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | High (7.5) | 0.76% | PoC | Dataease | 4/16/2026 | 6/17/2026 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializes job data BLOBs from… | |
| Analyzed | High (8.2) | 50% | Exploit | Dataease | 6/3/2025 | 6/17/2026 | DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known… | |
| Analyzed | High (7.7) | 22% | Exploit | Dataease | 6/3/2025 | 6/17/2026 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available. | |
| Analyzed | High (8.2) | 4.5% | Exploit | Dataease | 4/23/2025 | 6/17/2026 | DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8. | |
| Analyzed | Critical (9.3) | 50% | Exploit | Dataease | 1/10/2025 | 6/17/2026 | DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to… | |
| Analyzed | Critical (9.3) | 1.3% | Exploit | Dataease | 11/7/2024 | 6/17/2026 | DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in… | |
| Analyzed | Medium (5.3) | 16% | Exploit | Dataease | 4/8/2024 | 6/17/2026 | DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in… |