Access Control

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

1. Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE VulnerabilityCVE-2025-48999dataease · CVSS 6.8 · 11% likely

   CWE-923

2. Dataease redshift JDBC Connection Remote Code ExecutionCVE-2025-46566dataease · CVSS 6.8 · 0.8% likely

   CWE-923

3. Unauthorized users can delete applications in DataEaseCVE-2023-34463dataease · CVSS 8.1 · 0.7% likely

   CWE-862

4. DataEase has a privilege bypass vulnerabilityCVE-2023-35168dataease · CVSS 6.5 · 0.7% likely

   CWE-732

5. An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrat…CVE-2022-34112Dataease · 0.6% likely

   CWE-732

6. Dataease SQLBot API Endpoint assistant.py access controlCVE-2025-15597Dataease · CVSS 6.3 · 0.6% likely

   CWE-266

7. SQLBot: Remote Code Execution via Terminology PoisoningCVE-2026-32622dataease · CVSS 8.6 · 0.6% likely

   CWE-862

8. Arbitrary File Reading in DataEaseCVE-2024-31441dataease · CVSS 7.5 · 0.6% likely

   CWE-863

9. DataEase: Link Token Leakage Prior to Share Password/Ticket ValidationCVE-2026-50529dataease · CVSS 8.7 · 0.5% likely

   CWE-863

10. Unauthorized users can manipulate a dashboard created by an administrator in DataEaseCVE-2023-35164dataease · CVSS 6.3 · 0.4% likely

    CWE-862

11. DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read VulnerabilityCVE-2025-24974dataease · CVSS 7.3 · 0.4% likely

    CWE-862

12. DataEase: Unauthorized Access to Engine Database via previewSql EndpointCVE-2026-53730dataease · CVSS 8.7 · 0.4% likely

    CWE-862

13. DataEase before 2.10.26 Access Control Bypass via Share TicketsCVE-2026-82879dataease · CVSS 6.3 · 0.4% likely

    CWE-863

14. DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart EndpointsCVE-2026-82878dataease · CVSS 6.3 · 0.3% likely

    CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.