Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (6 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-77811 2 Aws, Opensearch 3 Amazon Opensearch Service, Opensearch Dashboards, Opensearch Dashboards Dashboards-observability Plugin 2026-08-27 8.7 High
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
CVE-2026-18420 2 Aws, Opensearch 2 Amazon Opensearch Service, Opensearch Dashboards 2026-08-25 8.8 High
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.
CVE-2026-18952 3 Amazon, Aws, Github 3 Aws Opensearch, Opensearch, Opensearch 2026-08-21 8.1 High
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.
CVE-2026-75897 2 Aws, Opensearch 2 Amazon Opensearch Service, Opensearch Dashboards 2026-08-18 7.5 High
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
CVE-2026-18428 2 Aws, Github 2 Opensearch, Opensearch 2026-08-13 8.8 High
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.
CVE-2026-19311 2 Aws, Github 2 Opensearch, Opensearch 2026-08-12 8.1 High
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.