Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-84942

Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aws Opensearch
Products
Amazon Opensearch Service Opensearch Dashboards
CVE-2026-77811

Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards

Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Aws Opensearch
Products
Amazon Opensearch Service Opensearch Dashboards Opensearch Dashboards Dashboards-observability Plugin
CVE-2026-18420

RCE via Prototype Pollution in OpenSearch Dashboards

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aws Opensearch
Products
Amazon Opensearch Service Opensearch Dashboards
CVE-2026-75897

Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aws Opensearch
Products
Amazon Opensearch Service Opensearch Dashboards