Metabase

Metabase is a self-hosted business intelligence and data visualization platform that runs within organizations' infrastructure and integrates deeply with their data warehouses and databases, creating a significant attack surface around data access and web-facing query interfaces. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and a moderate tendency toward public exploit availability, reflecting the platform's appeal as a target for data exfiltration and lateral movement. The exposure concentrates exclusively in the Metabase product itself and recurs through weakness classes including sensitive-information disclosure, code injection, cross-site scripting, and server-side request forgery—patterns typical of web applications that broker authenticated access to backend data systems. Defenders should prioritize patching this vendor's releases, restrict network access to Metabase instances, and audit user permissions and query logs; live severity, exploitation activity, and exposure counts are shown alongside this summary.