EUVD-2026-63592

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

CVE-2026-18420

Improper input validation in OpenSearch Dashboards' TSVB plugin enables prototype pollution via crafted JSON to the metrics visualization API, yielding authenticated remote code execution. CVSS 3.1 scores 8.8 (HIGH). Affected versions are fixed in OpenSearch Dashboards 3.8.0. Exploitation in the ...