CVE-2026-18952 Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...

CVE-2026-19311 Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

CVE-2026-19311 Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

CVE-2026-19311

The CVE-2026-19311 issue affects the Amazon OpenSearch Alerting plugin, specifically the Execute Monitor API. A missing authorization check in the API could allow an authenticated remote user to read, modify, or delete arbitrary index data through a crafted inline monitor request using unintentio...

EUVD-2026-57420

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

CVE-2026-19311

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

PT-2026-71210

Name of the Vulnerable Software and Affected Versions OpenSearch Security Analytics plugin affected versions not specified Description Missing input validation in the threat intelligence feed parser allows an authenticated remote user to perform server-side request forgery SSRF—a technique where ...

GHSA-38GX-CFQF-F652 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, prism, opensearch-dashboards-fips, redisinsight, lerna, jitsucom-jitsu, wazuh-dashboard-fips, nextcloud-server, wazuh-dashboard, opensearch-dashboards, semaphore, librechat, kubeflow-centraldashboard, awx, kibana...

CVE-2026-67314 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, prism, awx, opensearch-dashboards-fips, redisinsight, lerna, jitsucom-jitsu, gitlab-rails-ce-fips, nextcloud-server, wazuh-dashboard, wazuh-dashboard-fips, opensearch-dashboards, semaphore, librechat, kubeflow-centraldashboard, gitlab-rails-c...

CVE-2026-67314 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, nextcloud-server, kubeflow-centraldashboard, langfuse, opensearch-dashboards, lerna, prism...

GHSA-38GX-CFQF-F652 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, nextcloud-server, kubeflow-centraldashboard, langfuse, opensearch-dashboards, lerna, prism...

CVE-2026-69192 vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-pipelines, langfuse, opensearch-dashboards, lerna, prism, saf, pulumi, sqlpad, code-server, npm...

GHSA-22JQ-VG5J-6VGG vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-pipelines, langfuse, opensearch-dashboards, lerna, prism, saf, pulumi, sqlpad, code-server, npm...

CVE-2026-54272 vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-pipelines, langfuse, opensearch-dashboards, lerna, prism, saf, pulumi, sqlpad, code-server, npm...

CVE-2026-69198 vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-pipelines, langfuse, opensearch-dashboards, lerna, prism, saf, pulumi, sqlpad, code-server, npm...

GHSA-MWP4-54F8-5FHR vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-pipelines, langfuse, opensearch-dashboards, lerna, prism, saf, pulumi, sqlpad, code-server, npm...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.56.0), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +112 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=1.0.4, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.96.0-09 and more Source cves: CVE-2026-59648https://vulners.c...

CLEANSTART-2026-JN30531 Security fixes in opensearch-k8s-operator-fips 2.7.0-r7

Package opensearch-k8s-operator-fips version 2.7.0-r7 fixes 3 vulnerabilities: CVE-2025-47907, CVE-2025-0913, CVE-2025-4673...

CLEANSTART-2026-QM93035 Security fixes in opensearch-k8s-operator-fips 2.6.1-r1

Package opensearch-k8s-operator-fips version 2.6.1-r1 fixes 20 vulnerabilities: CVE-2025-47911, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186...

CLEANSTART-2026-EH27916 Security fixes in opensearch-k8s-operator-fips 2.8.0-r3

Package opensearch-k8s-operator-fips version 2.8.0-r3 fixes 8 vulnerabilities: CVE-2026-32280, CVE-2026-32289, CVE-2026-32282, CVE-2026-27140, CVE-2026-32288...