# DataEase vulnerabilities Source: https://junglewise.ai/threats/vendors/dataease Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/dataease.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 42 vulnerabilities in DataEase: 3 in the last 7 days and 15 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123992, was published on 7 November 2026. 6 vulnerabilities in the last four weeks, up 20% on the four before (5). 2 technologies have a page of their own. ## Counts - Last 7 days: 3 - Last 30 days: 5 - Last 90 days: 15 - All time: 42 (3 critical, 0 exploited in the wild) ## About DataEase An open-source data visualization and analysis platform. ## Latest DataEase vulnerabilities - [CVE-2026-123992: DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-123991: DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected) (high, CVSS 7.3, published 7 Nov 2026) - [CVE-2026-123990: DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2) (high, CVSS 7.3, published 7 Nov 2026) - [CVE-2026-102756: DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool) (info, published 14 Oct 2026) - [CVE-2026-102755: DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool) (info, published 14 Oct 2026) - [CVE-2026-108824: DataEase SQL injection in calculated field expression](https://junglewise.ai/threats/cve-2026-108824-a-flaw-has-been-found-in-dataease-up-to-3-0-0-the-impacted) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-53557: DataEase SQLBot second-order SQL injection in datasource deletion](https://junglewise.ai/threats/cve-2026-53557-dataease-sqlbot-second-order-sql-injection-in-datasource-deletion) (info, CVSS 7.2, published 17 Sep 2026) - [CVE-2026-53556: DataEase SQLBot SQL injection in previewData endpoint](https://junglewise.ai/threats/cve-2026-53556-dataease-sqlbot-sql-injection-in-previewdata-endpoint) (info, CVSS 7.1, published 17 Sep 2026) - [CVE-2026-53555: DataEase SQLBot stored cross-site scripting in assistant UI logo upload](https://junglewise.ai/threats/cve-2026-53555-dataease-sqlbot-stored-cross-site-scripting-in-assistant-ui-logo) (info, CVSS 7.1, published 17 Sep 2026) - [CVE-2026-53554: DataEase SQLBot arbitrary code execution in parseExcel](https://junglewise.ai/threats/cve-2026-53554-dataease-sqlbot-arbitrary-code-execution-in-parseexcel) (info, CVSS 8.8, published 17 Sep 2026) - [CVE-2023-40772: DataEase directory traversal in StaticResourceController](https://junglewise.ai/threats/cve-2023-40772-dataease-directory-traversal-in-staticresourcecontroller) (medium, CVSS 4.3, published 14 Sep 2026) - [CVE-2026-90529: DataEase cross-site scripting in symbolic map tooltip](https://junglewise.ai/threats/cve-2026-90529-dataease-cross-site-scripting-in-symbolic-map-tooltip) (low, CVSS 3.5, published 13 Sep 2026) - [CVE-2026-82879: DataEase access control bypass in sharing link module](https://junglewise.ai/threats/cve-2026-82879-dataease-access-control-bypass-in-sharing-link-module) (medium, CVSS 6.3, published 31 Aug 2026) - [CVE-2026-82878: DataEase authorization bypass on geographic and dashboard APIs](https://junglewise.ai/threats/cve-2026-82878-dataease-authorization-bypass-on-geographic-and-dashboard-apis) (medium, CVSS 6.3, published 31 Aug 2026) - [CVE-2026-45532: DataEase path traversal in static resource endpoint](https://junglewise.ai/threats/cve-2026-45532-dataease-path-traversal-in-static-resource-endpoint) (info, CVSS 7.5, published 18 Aug 2026) - [CVE-2026-50124: DataEase RCE via Zip Protocol and H2 Database File Upload](https://junglewise.ai/threats/cve-2026-50124-dataease-rce-via-zip-protocol-and-h2-database-file-upload) (info, CVSS 7.1, published 15 Jul 2026) - [CVE-2026-50030: DataEase SQL injection in SQL preview API](https://junglewise.ai/threats/cve-2026-50030-dataease-sql-injection-in-sql-preview-api) (info, CVSS 7.1, published 15 Jul 2026) - [CVE-2026-49867: DataEase stored XSS in template static resources](https://junglewise.ai/threats/cve-2026-49867-dataease-stored-xss-in-template-static-resources) (info, CVSS 6.3, published 15 Jul 2026) - [CVE-2026-46684: DataEase Enterprise authentication bypass and remote code execution](https://junglewise.ai/threats/cve-2026-46684-dataease-enterprise-authentication-bypass-and-remote-code) (info, CVSS 9.5, published 15 Jul 2026) - [CVE-2026-45535: DataEase stored SQL injection in SQL-type datasets](https://junglewise.ai/threats/cve-2026-45535-dataease-stored-sql-injection-in-sql-type-datasets) (info, CVSS 8.7, published 15 Jul 2026) - [CVE-2026-45534: DataEase Remote Code Execution in Redshift datasource connection](https://junglewise.ai/threats/cve-2026-45534-dataease-remote-code-execution-in-redshift-datasource-connection) (info, CVSS 9, published 15 Jul 2026) - [CVE-2026-45533: DataEase path traversal in export-center bulk delete API](https://junglewise.ai/threats/cve-2026-45533-dataease-path-traversal-in-export-center-bulk-delete-api) (info, CVSS 8.3, published 15 Jul 2026) - [CVE-2026-45419: DataEase path traversal and arbitrary file write in template management](https://junglewise.ai/threats/cve-2026-45419-dataease-path-traversal-and-arbitrary-file-write-in-template) (info, CVSS 8.5, published 15 Jul 2026) - [CVE-2026-45417: DataEase SQL injection in CalciteProvider datasource check](https://junglewise.ai/threats/cve-2026-45417-dataease-sql-injection-in-calciteprovider-datasource-check) (info, CVSS 8.7, published 15 Jul 2026) - [CVE-2026-45320: DataEase SQL injection in dashboard SQL variables](https://junglewise.ai/threats/cve-2026-45320-dataease-sql-injection-in-dashboard-sql-variables) (info, CVSS 8.7, published 15 Jul 2026) ## Most severe DataEase vulnerabilities - [CVE-2025-64163: DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a…](https://junglewise.ai/threats/cve-2025-64163-dataease-is-an-open-source-data-visualization-analysis-tool-in) (critical, CVSS 9.8, published 6 Nov 2025) - [CVE-2025-64164: Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly…](https://junglewise.ai/threats/cve-2025-64164-dataease-is-an-open-source-data-visualization-analysis-tool-in) (critical, CVSS 9.8, published 6 Nov 2025) - [CVE-2025-64428: Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI…](https://junglewise.ai/threats/cve-2025-64428-dataease-is-an-open-source-data-visualization-analysis-tool) (critical, CVSS 9.8, published 20 Nov 2025) - [CVE-2026-33324: dataease SQLBot prompt injection in Text2SQL chat interface](https://junglewise.ai/threats/cve-2026-33324-dataease-sqlbot-prompt-injection-in-text2sql-chat-interface) (high, CVSS 8.8, published 5 May 2026) - [CVE-2026-123991: DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected) (high, CVSS 7.3, published 7 Nov 2026) - [CVE-2026-123990: DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2) (high, CVSS 7.3, published 7 Nov 2026) - [CVE-2026-108824: DataEase SQL injection in calculated field expression](https://junglewise.ai/threats/cve-2026-108824-a-flaw-has-been-found-in-dataease-up-to-3-0-0-the-impacted) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-82879: DataEase access control bypass in sharing link module](https://junglewise.ai/threats/cve-2026-82879-dataease-access-control-bypass-in-sharing-link-module) (medium, CVSS 6.3, published 31 Aug 2026) - [CVE-2026-82878: DataEase authorization bypass on geographic and dashboard APIs](https://junglewise.ai/threats/cve-2026-82878-dataease-authorization-bypass-on-geographic-and-dashboard-apis) (medium, CVSS 6.3, published 31 Aug 2026) - [CVE-2026-5417: Dataease SQLbot SSRF in Elasticsearch Handler](https://junglewise.ai/threats/cve-2026-5417-dataease-sqlbot-ssrf-in-elasticsearch-handler) (medium, CVSS 4.7, published 2 Apr 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up 20% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 5 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## DataEase technologies - [DataEase](https://junglewise.ai/threats/technologies/dataease): 35 vulnerabilities - [DataEase SQLBot](https://junglewise.ai/threats/technologies/sqlbot): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "DataEase vulnerabilities", https://junglewise.ai/threats/vendors/dataease, 12 November 2026.