CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...

CVE-2026-33387

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

CVE-2026-33387 Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

EUVD-2026-72761

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

CVE-2026-33387

A template injection vulnerability in the Dashboards functionality of Nozomi Networks Guardian/CMC (before 26.3.0 ) is caused by improper validation of an input parameter. An authenticated user with required privileges can define a dashboard containing a malicious payload, or a victim can be soci...

PT-2026-88317

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...

Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

Summary A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. Impact An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into...

GHSA-JQFF-G426-HQXP vulnerabilities

Vulnerabilities for packages: yaml-language-server, opensearch-dashboards, keep-fips, argo-workflows, kibana, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, gitlab-rails-ce, wazuh-dashboard-fips, prism, unleash-proxy, nextcloud-server, arangodb, tensorflow-gpu-jupyter,...

GHSA-F65P-4M7J-42XC vulnerabilities

Vulnerabilities for packages: yaml-language-server, opensearch-dashboards, keep-fips, argo-workflows, kibana, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, gitlab-rails-ce, wazuh-dashboard-fips, prism, unleash-proxy, nextcloud-server, arangodb, tensorflow-gpu-jupyter,...

GHSA-FPH4-WMHF-6FWF vulnerabilities

Vulnerabilities for packages: yaml-language-server, opensearch-dashboards, argo-workflows, keep-fips, kibana, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, wazuh-dashboard-fips, prism, unleash-proxy, nextcloud-server, arangodb, tensorflow-gpu-jupyter, opensearch-dashboards-fips,...

GHSA-5JGF-P345-68V8 vulnerabilities

Vulnerabilities for packages: yaml-language-server, opensearch-dashboards, keep-fips, kibana, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, wazuh-dashboard-fips, prism, unleash-proxy, nextcloud-server, arangodb, opensearch-dashboards-fips, langfuse, langfuse-fips, gitlab-rails-ce-fips...

GHSA-X5FP-WJ9C-MXMX vulnerabilities

Vulnerabilities for packages: json-server, opensearch-dashboards, azurite, sqlpad, argo-workflows, kibana, dotstatsuite-supercore, kubescape-grype-offline-db, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, gitlab-rails-ce, wazuh-dashboard-fips, redisinsight, prism, unleash-proxy,...

GHSA-4MJR-XMP4-GH2G vulnerabilities

Vulnerabilities for packages: json-server, opensearch-dashboards, azurite, sqlpad, argo-workflows, kibana, dotstatsuite-supercore, kubescape-grype-offline-db, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, gitlab-rails-ce, wazuh-dashboard-fips, redisinsight, prism, unleash-proxy,...

CVE-2026-75899 vulnerabilities

Vulnerabilities for packages: yaml-language-server, opensearch-dashboards, argo-workflows, keep-fips, kibana, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, wazuh-dashboard-fips, prism, unleash-proxy, nextcloud-server, arangodb, tensorflow-gpu-jupyter, opensearch-dashboards-fips,...

CVE-2026-75931 vulnerabilities

Vulnerabilities for packages: yaml-language-server, opensearch-dashboards, keep-fips, kibana, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, wazuh-dashboard-fips, prism, unleash-proxy, nextcloud-server, arangodb, opensearch-dashboards-fips, langfuse, langfuse-fips, gitlab-rails-ce-fips...

CVE-2026-82417 vulnerabilities

Vulnerabilities for packages: json-server, opensearch-dashboards, azurite, sqlpad, argo-workflows, kibana, dotstatsuite-supercore, kubescape-grype-offline-db, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, gitlab-rails-ce, wazuh-dashboard-fips, redisinsight, prism, unleash-proxy,...

CVE-2026-82562 vulnerabilities

Vulnerabilities for packages: json-server, opensearch-dashboards, azurite, sqlpad, argo-workflows, kibana, dotstatsuite-supercore, kubescape-grype-offline-db, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, gitlab-rails-ce, wazuh-dashboard-fips, redisinsight, prism, unleash-proxy,...

CVE-2026-75975 vulnerabilities

Vulnerabilities for packages: yaml-language-server, opensearch-dashboards, keep-fips, argo-workflows, kibana, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, gitlab-rails-ce, wazuh-dashboard-fips, prism, unleash-proxy, nextcloud-server, arangodb, tensorflow-gpu-jupyter,...

CVE-2026-76172 vulnerabilities

Vulnerabilities for packages: yaml-language-server, opensearch-dashboards, keep-fips, argo-workflows, kibana, unleash, unleash-fips, tileserver-gl, tileserver-gl-fips, gitlab-rails-ce, wazuh-dashboard-fips, prism, unleash-proxy, nextcloud-server, arangodb, tensorflow-gpu-jupyter,...

CVE-2026-67313 vulnerabilities

Vulnerabilities for packages: awx, opensearch-dashboards, azurite, kibana, gitlab-rails-ce, wazuh-dashboard-fips, redisinsight, prism, kubeflow-centraldashboard, nextcloud-server, arangodb, lerna, opensearch-dashboards-fips, semaphore, langfuse, langfuse-fips, gitlab-rails-ce-fips, wazuh-dashboar...