OP
Vendor
openobserve
9
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-63645 | OP openobserve openobserve | 7.5 | Sep 24 | OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials |
| CVE-2026-39361 | OP openobserve openobserve | 7.7 | Apr 7 | OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url |
| CVE-2025-66223 | OP openobserve openobserve | 8.4 | Nov 29 | OpenObserve's Invite Token Lifecycle Misconfiguration |
| CVE-2025-64744 | OP openobserve openobserve | 3.5 | Nov 13 | OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails |
| CVE-2024-55954 | OP openobserve openobserve | 8.7 | Jan 16 | OpenObserve Improper Authorization Allows Admin User to Remove Root User |
| CVE-2024-41809 | OP openobserve openobserve | 6.1 | Jul 25 | OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue` |
| CVE-2024-41808 | OP openobserve openobserve | 5.4 | Jul 25 | OpenObserve stored XSS vulnerability may lead to complete account takeover |
| CVE-2024-24830 | OP openobserve openobserve | 8.8 | Feb 8 | OpenObserve Privilege Escalation Vulnerability in Users API |
| CVE-2024-25106 | OP openobserve openobserve | 6.5 | Feb 8 | OpenObserve Unauthorized Access Vulnerability in Users API |