CVE-2026-4819 | Medium | 4.9 | 2026-03-31 | In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana. |
CVE-2026-4818 | Medium | 6.8 | 2026-03-31 | In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management opera… |
CVE-2026-4799 | Medium | 4.3 | 2026-03-31 | In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL. |
CVE-2025-13653 | Medium | 4.3 | 2025-12-01 | In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use speci… |
CVE-2025-12149 | | | 2025-11-14 | In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signal… |
CVE-2025-12148 | | | 2025-10-29 | In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address).
While the content of these fie… |
CVE-2025-12147 | | | 2025-10-29 | In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields.
When an FLS exclusion rule… |
CVE-2019-13423 | High | 8.8 | 2019-08-23 | Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user wh… |
CVE-2019-13422 | Medium | 6.1 | 2019-08-23 | Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon… |
CVE-2019-13421 | Medium | 4.9 | 2019-08-23 | Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal… |
CVE-2019-13416 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster igno… |
CVE-2019-13415 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not autho… |
CVE-2019-13420 | Medium | 5.9 | 2019-08-13 | Search Guard versions before 21.0 had an timing side channel issue when using the internal user database. |
CVE-2019-13419 | High | 7.5 | 2019-08-13 | Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. |
CVE-2019-13418 | High | 7.5 | 2019-08-12 | Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. |
CVE-2019-13417 | Medium | 5.3 | 2019-08-12 | Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user… |