Elasticsearch security vulnerabilities
Open-source infrastructure. Public CVE monitoring for Elasticsearch. Vendor security advisories are linked on this page.
Built for Operators of this product.
77 public records · 0 security-fix timeline events. 2 published in the last 7 days. 43 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 3
- Medium 3
- Low 1
2026-08-037 issues2026-10-31
Known exploited
View all known exploitedRecently published
Browse catalog- MediumIncorrect Authorization in Kibana Leading to Sensitive Information DisclosureCheck if you run itEPSS 0.31%Oct 14, 2026
- MediumMissing Authorization in Kibana Leading to Information DisclosureCheck if you run itEPSS 0.21%Oct 14, 2026
- HighAuthorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data InterceptionCheck if you run itEPSS 0.35%Oct 14, 2026
- Medium6.5Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation.Check if you run itEPSS 0.26%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.27%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.33%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.33%May 28, 2026
- High7.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist.Check if you run itEPSS 0.30%May 28, 2026
- Medium5.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection.Check if you run itEPSS 0.14%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.27%May 28, 2026