Login Request a demo
OP
Product
openobserve
by openobserve · last CVE Sep 24, 2026
9
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 0High 5Medium 3Low 1
Severity
All severities9Critical0High5Medium3Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add openobserve to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-24830
8.8
1%
Feb 8
OpenObserve Privilege Escalation Vulnerability in Users API
Affected: < 0.8.0
CVE-2024-55954
8.7
1%
Jan 16
OpenObserve Improper Authorization Allows Admin User to Remove Root User
Affected: < 0.14.1
CVE-2025-66223
8.4
0%
Nov 29
OpenObserve's Invite Token Lifecycle Misconfiguration
Affected: < 0.16.0
CVE-2026-39361
7.7
0%
Apr 7
OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
Affected: <= 0.70.3
CVE-2026-63645
7.5
0%
Sep 24
OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials
Affected: < 0.90.3
CVE-2024-25106
6.5
0%
Feb 8
OpenObserve Unauthorized Access Vulnerability in Users API
Affected: < 0.8.0
CVE-2024-41809
6.1
0%
Jul 25
OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`
Affected: >= 0.4.4, < 0.10.0
CVE-2024-41808
5.4
1%
Jul 25
OpenObserve stored XSS vulnerability may lead to complete account takeover
Affected: <= 0.9.1
CVE-2025-64744
3.5
0%
Nov 13
OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails
Affected: <= 0.16.1
Showing 9