Elastic
Page 2 of 4 — Elastic CVEs from a corpus of 382, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49096 | Medium | 4.3 | 2026-08-13 | Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comm… |
CVE-2026-49089 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression… |
CVE-2026-63263 | Medium | 6.5 | 2026-07-22 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user ma… |
CVE-2026-63262 | Medium | 4.3 | 2026-07-22 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level acce… |
CVE-2026-63261 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user c… |
CVE-2026-63260 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-pr… |
CVE-2026-63259 | Medium | 4.3 | 2026-07-21 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled… |
CVE-2026-63145 | Medium | 4.3 | 2026-07-21 | Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not… |
CVE-2026-63144 | Medium | 6.5 | 2026-07-21 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authentica… |
CVE-2026-63143 | Medium | 4.3 | 2026-07-21 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileg… |
CVE-2026-63142 | Medium | 5.0 | 2026-07-21 | Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request re… |
CVE-2026-63141 | Medium | 6.3 | 2026-07-21 | Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the requir… |
CVE-2026-63140 | Medium | 6.5 | 2026-07-21 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request contai… |
CVE-2026-63139 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user… |
CVE-2026-63136 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges… |
CVE-2026-56147 | High | 7.1 | 2026-07-21 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise v… |
CVE-2026-56146 | Medium | 5.4 | 2026-07-21 | Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclos… |
CVE-2026-56145 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated… |
CVE-2026-56144 | Medium | 5.3 | 2026-07-21 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls… |
CVE-2026-49092 | Medium | 4.3 | 2026-07-21 | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly… |
CVE-2026-42397 | Medium | 6.5 | 2026-07-21 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-49091 | High | 8.0 | 2026-07-01 | Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply sp… |
CVE-2026-49090 | Medium | 6.5 | 2026-07-01 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can su… |
CVE-2026-56152 | Medium | 5.3 | 2026-07-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC… |
CVE-2026-56151 | Medium | 6.5 | 2026-07-01 | Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specia… |
CVE-2026-56150 | Medium | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacke… |
CVE-2026-56149 | Medium | 4.9 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user wi… |
CVE-2026-56148 | Medium | 6.5 | 2026-07-01 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a spec… |
CVE-2026-49088 | Medium | 4.4 | 2026-07-01 | Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (… |
CVE-2026-49087 | Medium | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-49095 | Medium | 6.5 | 2026-05-28 | Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet manag… |
CVE-2026-49094 | Medium | 6.5 | 2026-05-28 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-lev… |
CVE-2026-49093 | Medium | 6.3 | 2026-05-28 | Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connecto… |
CVE-2026-42400 | Medium | 6.5 | 2026-05-28 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a spec… |
CVE-2026-42399 | Medium | 6.5 | 2026-05-28 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user… |
CVE-2026-42398 | High | 7.7 | 2026-05-28 | Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection al… |
CVE-2026-42401 | Medium | 4.1 | 2026-05-28 | Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch… |
CVE-2026-33464 | Medium | 6.5 | 2026-05-28 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low… |
CVE-2026-33463 | Medium | 5.3 | 2026-05-28 | Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration ti… |
CVE-2026-33462 | Medium | 4.6 | 2026-05-28 | A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a das… |
CVE-2026-33467 | Medium | 5.9 | 2026-04-28 | Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to o… |
CVE-2026-33466 | High | 8.1 | 2026-04-08 | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Rel… |
CVE-2026-33459 | Medium | 6.5 | 2026-04-08 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to… |
CVE-2026-33458 | Medium | 6.3 | 2026-04-08 | Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution pri… |
CVE-2026-4498 | High | 7.7 | 2026-04-08 | Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBA… |
CVE-2026-33461 | High | 7.7 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploi… |
CVE-2026-33460 | Medium | 4.3 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management… |
CVE-2026-26940 | Medium | 6.5 | 2026-03-19 | Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocatio… |
CVE-2026-26939 | Medium | 6.5 | 2026-03-19 | Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolati… |
CVE-2026-26933 | Medium | 5.7 | 2026-03-19 | Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC… |
CVE-2026-26931 | Medium | 5.7 | 2026-03-19 | Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Alloca… |
CVE-2026-26938 | High | 8.6 | 2026-02-26 | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary… |
CVE-2026-26937 | Medium | 6.5 | 2026-02-26 | Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) |
CVE-2026-26936 | Medium | 4.9 | 2026-02-26 | Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Expon… |
CVE-2026-26935 | Medium | 6.5 | 2026-02-26 | Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-1… |
CVE-2026-26934 | Medium | 6.5 | 2026-02-26 | Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Serv… |
CVE-2026-26932 | Medium | 5.7 | 2026-02-26 | Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153)… |
CVE-2026-0532 | High | 8.6 | 2026-01-14 | External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure thr… |
CVE-2026-0529 | Medium | 6.5 | 2026-01-14 | Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specia… |
CVE-2026-0543 | Medium | 6.5 | 2026-01-13 | Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted e… |
CVE-2026-0531 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrie… |
CVE-2026-0530 | Medium | 6.5 | 2026-01-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. Th… |
CVE-2026-0528 | Medium | 6.5 | 2026-01-13 | Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153… |
CVE-2025-68422 | Medium | 4.3 | 2025-12-18 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restric… |
CVE-2025-68390 | Medium | 4.9 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Exces… |
CVE-2025-68389 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130… |
CVE-2025-68387 | Medium | 6.1 | 2025-12-18 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in con… |
CVE-2025-68386 | Medium | 4.3 | 2025-12-18 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type t… |
CVE-2025-68385 | High | 7.2 | 2025-12-18 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in conte… |
CVE-2025-68388 | Medium | 5.3 | 2025-12-18 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory an… |
CVE-2025-68384 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CA… |
CVE-2025-68383 | Medium | 6.5 | 2025-12-18 | Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to… |
CVE-2025-68382 | Medium | 6.5 | 2025-12-18 | Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a de… |
CVE-2025-68381 | Medium | 6.5 | 2025-12-18 | Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the appli… |
CVE-2025-37732 | Medium | 5.4 | 2025-12-15 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s… |
CVE-2025-37731 | Medium | 6.8 | 2025-12-15 | Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to ha… |
CVE-2025-37734 | Medium | 4.3 | 2025-11-12 | Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. |
CVE-2025-37736 | High | 8.8 | 2025-11-07 | Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed… |
CVE-2025-37735 | High | 7.0 | 2025-11-06 | Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running a… |
CVE-2025-37729 | Critical | 9.1 | 2025-10-13 | Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltr… |
CVE-2025-37727 | Medium | 5.7 | 2025-10-10 | Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the… |
CVE-2025-25018 | High | 8.7 | 2025-10-10 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) |
CVE-2025-25017 | High | 8.2 | 2025-10-10 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) |
CVE-2025-37728 | Medium | 5.4 | 2025-10-07 | Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credenti… |
CVE-2025-25009 | High | 8.7 | 2025-10-07 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. |
CVE-2025-25010 | Medium | 6.5 | 2025-08-28 | Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana… |
CVE-2025-25011 | High | 7.0 | 2025-07-30 | An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises fro… |
CVE-2025-0712 | High | 7.0 | 2025-07-30 | An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises fro… |
CVE-2025-25012 | Medium | 4.3 | 2025-06-25 | URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a speciall… |
CVE-2024-43706 | High | 7.6 | 2025-06-10 | Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. |
CVE-2025-37730 | Medium | 6.5 | 2025-05-06 | Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP outp… |
CVE-2025-25014 | Critical | 9.1 | 2025-05-06 | A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. |
CVE-2025-25016 | Medium | 4.3 | 2025-05-01 | Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient… |
CVE-2024-52979 | Medium | 6.5 | 2025-05-01 | Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service… |
CVE-2024-52976 | Medium | 4.4 | 2025-05-01 | Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via paramet… |
CVE-2024-11994 | Medium | 5.7 | 2025-05-01 | APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclo… |
CVE-2024-11390 | Medium | 5.4 | 2025-05-01 | Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScr… |
CVE-2023-46669 | Medium | 6.2 | 2025-05-01 | Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersona… |
CVE-2025-25013 | Medium | 6.5 | 2025-04-08 | Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmi… |
CVE-2024-12556 | High | 8.7 | 2025-04-08 | Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. |