opensearch-project

Products

Exploited and recent CVEs

• CVE-2026-63393 High 8.7 OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution 0.5%
• CVE-2025-62371 High 7.4 OpenSearch Data Prepper plugins trusts all SSL certificates by default 0.2%
• CVE-2024-55886 Medium 6.9 OpenTelemetry Logs source may lack authentication with some custom plugins 0.3%
• CVE-2024-43794 Medium 6.1 OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect 0.3%
• CVE-2024-39900 Medium 5.4 OpenSearch Dashboards Reports does not properly restrict access to private tenant resources 0.3%
• CVE-2024-39901 Medium 4.2 OpenSearch Observability does not properly restrict access to private tenant resources 0.3%
• CVE-2023-45807 Medium 5.4 OpenSearch Issue with tenant read-only permissions 0.5%
• CVE-2023-31141 Medium 4.8 OpenSearch issue with fine-grained access control during extremely rare race conditions 0.5%
• CVE-2023-25806 Medium 5.3 Time discrepancy in authentication responses in OpenSearch 0.3%
• CVE-2023-23933 Medium 5.7 Issue in Anomaly Detection with document and field level rules in numerical feature aggregations 0.5%
• CVE-2023-23612 Medium 4.7 Issue with whitespace in JWT roles in OpenSearch 0.8%
• CVE-2023-23613 Medium 5.7 Field-level security issue with .keyword fields in OpenSearch 0.9%
• CVE-2022-41917 Medium 4.3 Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch 0.6%
• CVE-2022-41918 Medium 6.3 Issue with fine-grained access control of indices backing data streams 0.5%
• CVE-2022-41906 High 7.7 OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF) 0.7%
• CVE-2022-35980 High 7.5 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information 1.2%
• CVE-2022-31115 High 8.8 Unsafe YAML deserialization in opensearch-ruby 1.6%