1330 matches found
CVE-2026-18952: Server-Side Request Forgery (SSRF)
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...
PT-2026-71210
Name of the Vulnerable Software and Affected Versions OpenSearch Security Analytics plugin affected versions not specified Description Missing input validation in the threat intelligence feed parser allows an authenticated remote user to perform server-side request forgery SSRF—a technique where ...
PT-2026-71211
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...
Plaintext Recovery against Post-Filtering Access Control
Fine-grained access control FGAC mechanisms such as row-level security RLS and document-level security DLS are widely deployed in databases to restrict access to data stored in physical indexing structures shared by multiple users e.g., in multi-tenant databases, or in the implementation of...
CVE-2026-67314 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, librechat, semaphore, langfuse-fips, wazuh-dashboard-fips, prism, nextcloud-server, kibana, awx, opensearch-dashboards, lerna, gitlab-rails-ce-fips, opensearch-dashboards-fips, gitlab-rails-ce, kubeflow-centraldashboard, redisinsight, jitsucom-jitsu,...
GHSA-38GX-CFQF-F652 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, librechat, semaphore, langfuse-fips, wazuh-dashboard-fips, prism, nextcloud-server, kibana, awx, opensearch-dashboards, lerna, opensearch-dashboards-fips, redisinsight, kubeflow-centraldashboard, jitsucom-jitsu, langfuse...
CVE-2026-67314 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, kubeflow-centraldashboard, jitsucom-jitsu, lerna, langfuse, nextcloud-server, prism...
GHSA-38GX-CFQF-F652 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, kubeflow-centraldashboard, jitsucom-jitsu, lerna, langfuse, nextcloud-server, prism...
deadair v0.5.1
Open-source SIEM detection health. Find enabled detections that are blind because their telemetry is missing, stale, late, or schema-incompatible. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly Real scan of a...
CVE-2026-54272 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, saf, kubeflow-pipelines, renovate, lerna, sqlpad, npm, code-server, langfuse, pulumi, prism...
CVE-2026-69198 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, saf, kubeflow-pipelines, renovate, lerna, sqlpad, npm, code-server, langfuse, pulumi, prism...
CVE-2026-69192 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, saf, kubeflow-pipelines, renovate, lerna, sqlpad, npm, code-server, langfuse, pulumi, prism...
GHSA-22JQ-VG5J-6VGG vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, saf, kubeflow-pipelines, renovate, lerna, sqlpad, npm, code-server, langfuse, pulumi, prism...
GHSA-MWP4-54F8-5FHR vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, saf, kubeflow-pipelines, renovate, lerna, sqlpad, npm, code-server, langfuse, pulumi, prism...
com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58059 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)
org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58059 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518056...
org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.8.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (2.1.11)
org.bouncycastle:bcpg-fips MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - org.opensearch:opensearch-plugin-cli =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09,...
org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)
org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-12817 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519214...
co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)
org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-12817 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519214...
com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-59647 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.11)
org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-59647 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18513020...
org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.8.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-fips (2.1.11)
org.bouncycastle:bcpg-fips MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - org.opensearch:opensearch-plugin-cli =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09,...