CLEANSTART-2026-QN62418 Security fixes in opensearch-dashboards-fips 3.5.0-r0

Package opensearch-dashboards-fips version 3.5.0-r0 fixes 30 vulnerabilities: ghsa-jg4p-7fhp-p32p, ghsa-2w6w-674q-4c4q, ghsa-9cx6-37pm-9jff, ghsa-r5fr-rjxr-66jc, ghsa-3v7f-55p6-f55p...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, opensearch-dashboards, wazuh-dashboard-fips, wazuh-dashboard...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, opensearch-dashboards, wazuh-dashboard-fips, wazuh-dashboard, opensearch-dashboards-fips...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, opensearch-dashboards, wazuh-dashboard-fips, wazuh-dashboard, opensearch-dashboards-fips...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, langfuse, nextcloud-server...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, langfuse, nextcloud-server...

EUVD-2026-46513

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: OpenSearch Dashboards. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-47026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: OpenSearch Dashboards. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CLEANSTART-2026-KT42152 Security fixes for CVE-2026-12143, CVE-2026-44979, CVE-2026-45249, CVE-2026-46625, CVE-2026-53550, CVE-2026-53655, ghsa-cmwh-pvxp-8882 applied in versions: 3.6.0-r4

Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-55880

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...

CVE-2026-55880

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...

CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...

CVE-2026-48801 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

GHSA-22P9-WV53-3RQ4 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

GHSA-RMMH-P597-PPVV vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2024-1899 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2026-28378

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers...

CVE-2026-55647

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable...

CVE-2026-28378 Cross-Organization Public Dashboard Deletion via Missing Org Isolation

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers...

CVE-2026-28378

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers...