Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownCVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory toolOct 14, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).EPSS 0.5%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).EPSS 0.5%May 28, 2026
- High7.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist.EPSS 0.4%May 28, 2026
- Medium5.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection.EPSS 0.1%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130).EPSS 0.5%May 28, 2026
- Medium5.3Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure.EPSS 0.4%May 28, 2026
- High7.3A path traversal vulnerability was identified in Kibana's dashboard management functionality.EPSS 0.2%May 28, 2026
- High7.7Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files fr…Feb 26, 2026
- High7.5Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)Feb 26, 2026
- High7.5Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential B…Feb 26, 2026
- High7.5Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)Feb 26, 2026
- Medium6.5Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via…Feb 26, 2026
- High7.5Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153).Feb 26, 2026
- Critical10.0Kibana Arbitrary Code ExecutionKEVEPSS 95.3%Mar 25, 2019
- Critical9.8Elasticsearch Groovy Scripting Engine Remote Code Execution VulnerabilityKEVEPSS 99.9%Feb 17, 2015
- High8.1Elasticsearch Remote Code Execution VulnerabilityKEVEPSS 88.6%Jul 28, 2014
17 records · page 1 of 1
PreviousNext