CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin

unknownCVE-2026-18420

Bulletin ID: 2026-068-AWS Publication Date: 07/31/2026 11:00 AM PDT Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-31
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-068-aws/

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-18420	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Remote Code

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-14836: The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate li…nvd · 2026-08-01
unknownCVE-2026-14561: The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its on…nvd · 2026-08-01
mediumCVE-2026-13362: The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Si…nvd · 2026-08-01
highCVE-2026-34641: Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrar…nvd · 2026-07-31
criticalCVE-2026-68770: sentence-transformers contains a security control bypass vulnerability that allows attackers t…nvd · 2026-07-31
unknownIncomplete fix for CVE-2025-4318 code injection in Amazon &commat;aws-amplify/codegen-ui-reactaws · 2026-07-31

CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin

Details

Referenced CVEs

Recent advisories for - Remote Code

More from AWS Security Bulletins