EUVD-2026-23284

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the...

CVE-2026-33083

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the orderDirection parameter used in dataset-related endpoints including /de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset. The Order2SQLOb...

CVE-2024-10272

The CVE-2024-10272 entry concerns lunary-ai/lunary with a broken access control flaw on the /v1/datasets endpoint. According to multiple sources, an attacker can view the content of any dataset without authorization by issuing a GET to /v1/datasets without a valid authorization token. The associa...