Veille CVE

Recherche « OpenSearch Dashboards »

5 CVE

Critique 0 Élevée 5 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « OpenSearch Dashboards » ✕
  1. CVE-2026-84942 8.7 Élevée

    AWS Amazon OpenSearch Service · OpenSearch Dashboards

    Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.

  2. CVE-2026-77811 8.7 Élevée

    AWS Amazon OpenSearch Service · OpenSearch Dashboards dashboards-observability plugin

    Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.

  3. CVE-2026-18420 8.8 Élevée

    AWS Amazon OpenSearch Service · OpenSearch Dashboards

    Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

  4. CVE-2026-75897 7.5 Élevée

    OpenSearch Dashboards · AWS Amazon OpenSearch Service

    Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

  5. CVE-2026-47026 7.4 Élevée

    Oracle Corporation PeopleSoft Enterprise PeopleTools · Oracle peoplesoft enterprise peopletools

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).