CVE-2026-25958

Cube (semantic layer) versions 0.27.19 up to before 1.5.13, 1.4.2, and 1.0.14 are vulnerable to privilege escalation via a specially crafted request with a valid API token. The issue is fixed in 1.5.13, 1.4.2, and 1.0.14. CVSS v3.1 base score 7.7 (HIGH) with attack vector Network, attack complexi...

CVE-2023-50709

CVE-2023-50709 affects Cube.js: prior to v0.34.34, a specially crafted request to a Cube API endpoint can render the entire Cube API unavailable (DoS). Root cause is a vulnerability in the Cube API endpoint handling that allows service disruption. The issue has been patched in v0.34.34; upgrade t...