Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-18952

Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Amazon Aws Github
Products
Aws Opensearch Opensearch Opensearch
CVE-2026-18428

SQL Query Validation Bypass in OpenSearch Direct Query

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aws Github
Products
Opensearch Opensearch
CVE-2026-19311

Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws Github
Products
Opensearch Opensearch