opensearch-project vulnerabilities

CVEs per yearBy the year they were published

1. 20225
2. 20236
3. 20244
4. 20251
5. 20261

Newest CVEs

• CVE-2026-63393

  OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

  opensearch-project · sql

  High8.7
• CVE-2025-62371

  OpenSearch Data Prepper plugins trusts all SSL certificates by default

  opensearch-project · data-prepper

  High7.4
• CVE-2024-55886

  OpenTelemetry Logs source may lack authentication with some custom plugins

  opensearch-project · data-prepper

  Medium6.9
• CVE-2024-43794

  OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect

  opensearch-project · security-dashboards-plugin

  Medium6.1
• CVE-2024-39900

  OpenSearch Dashboards Reports does not properly restrict access to private tenant resources

  opensearch-project · reporting

  Medium5.4
• CVE-2024-39901

  OpenSearch Observability does not properly restrict access to private tenant resources

  opensearch-project · observability

  Medium4.2
• CVE-2023-45807

  OpenSearch Issue with tenant read-only permissions

  opensearch-project · security

  Medium5.4
• CVE-2023-31141

  OpenSearch issue with fine-grained access control during extremely rare race conditions

  opensearch-project · security

  Medium4.8
• CVE-2023-25806

  Time discrepancy in authentication responses in OpenSearch

  opensearch-project · security

  Medium5.3
• CVE-2023-23933

  Issue in Anomaly Detection with document and field level rules in numerical feature aggregations

  opensearch-project · anomaly-detection

  Medium5.7