Approved changes feed: RSS · Atom
cpe:2.3:a:cube-js:cube:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Cube Js (e6c51fe0-5492-55c2-a5c8-d927787c3707) |
|---|---|
| Product | Cube (df0166a4-5c57-5e15-ad0c-09f348bbab4a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-25958 |
vulnerable | 2026-06-08 07:53:20.645615 |
Cube privilege escalation via a specially crafted request
HIGH (7.7)
Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.
Published: 2026-02-09T22:42:54.404Z
Updated: 2026-02-11T21:26:55.991Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25957 |
vulnerable | 2026-06-08 07:53:20.644536 |
Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request
MEDIUM (6.5)
Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.
Published: 2026-02-09T22:39:16.121Z
Updated: 2026-02-11T21:23:47.950Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-50709 |
vulnerable | 2026-06-08 06:16:16.315739 |
Denial of service attack on the cube-api endpoint
MEDIUM (6.5)
Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption.
There are currently no workaround for older versions, and the recommendation is to upgrade.
Published: 2023-12-13T22:00:04.603Z
Updated: 2024-10-08T14:25:19.426Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.