{"items":[{"id":"CVE-2026-84942","published":"2026-09-08T19:41:25.224Z","updated":"2026-09-09T20:51:34.759Z","title":"Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards","severity":"MEDIUM","score":6.3,"vendor":"AWS","product":"Amazon OpenSearch Service","kev":false,"epss":0.00544,"kevAdded":null,"exploit":false},{"id":"CVE-2026-83497","published":"2026-08-31T18:36:30.615Z","updated":"2026-09-01T14:03:26.045Z","title":"Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination","severity":"HIGH","score":8.7,"vendor":"OpenSearch","product":"OpenSearch","kev":false,"epss":0.00962,"kevAdded":null,"exploit":false},{"id":"CVE-2026-77811","published":"2026-08-21T20:09:19.151Z","updated":"2026-08-27T16:46:19.625Z","title":"Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards","severity":"MEDIUM","score":6.2,"vendor":"AWS","product":"Amazon OpenSearch Service","kev":false,"epss":0.00518,"kevAdded":null,"exploit":false},{"id":"CVE-2026-18420","published":"2026-08-20T20:40:40.709Z","updated":"2026-08-25T19:19:07.471Z","title":"RCE via Prototype Pollution in OpenSearch Dashboards","severity":"HIGH","score":8.7,"vendor":"AWS","product":"Amazon OpenSearch Service","kev":false,"epss":0.00962,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75897","published":"2026-08-18T17:05:15.657Z","updated":"2026-08-18T19:21:13.427Z","title":"Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards","severity":"HIGH","score":8.7,"vendor":"OpenSearch","product":"OpenSearch Dashboards","kev":false,"epss":0.00716,"kevAdded":null,"exploit":false},{"id":"CVE-2025-9624","published":"2025-11-25T19:43:40.330Z","updated":"2025-12-15T14:04:03.148Z","title":"OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS","severity":"HIGH","score":8.3,"vendor":"OpenSearch","product":"OpenSearch","kev":false,"epss":0.00727,"kevAdded":null,"exploit":true}]}