Elasticsearch vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
77 matching records
- Low3.7CGA-9p95-3hjj-736cOpen the advisoryOct 25, 2026
- Medium4.8CGA-mcch-852w-6cc8Open the advisoryOct 25, 2026
- High7.5CGA-653w-q4v5-x7pgOpen the advisoryOct 21, 2026
- High7.1phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endp…Check if you run itEPSS 0.15%Oct 17, 2026
- UnknownCVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory toolCheck if you run itEPSS 0.42%Oct 14, 2026
- MediumIncorrect Authorization in Kibana Leading to Sensitive Information DisclosureCheck if you run itEPSS 0.31%Oct 14, 2026
- MediumMissing Authorization in Kibana Leading to Information DisclosureCheck if you run itEPSS 0.21%Oct 14, 2026
- HighAuthorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data InterceptionCheck if you run itEPSS 0.35%Oct 14, 2026
- UnknownCGA-xv9f-vqcx-9xjwOpen the advisoryOct 13, 2026
- UnknownCGA-v2pf-4v88-hw8jOpen the advisoryOct 2, 2026
- Medium6.5Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation.Check if you run itEPSS 0.26%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.27%May 28, 2026
- High7.7Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowl…Check if you run itEPSS 0.20%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.33%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.33%May 28, 2026
- High7.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist.Check if you run itEPSS 0.30%May 28, 2026
- Medium5.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection.Check if you run itEPSS 0.14%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.27%May 28, 2026
- Medium5.3Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure.Check if you run itEPSS 0.24%May 28, 2026
- High7.3A path traversal vulnerability was identified in Kibana's dashboard management functionality.Check if you run itEPSS 0.24%May 28, 2026
- Medium5.3phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoi…Check if you run itEPSS 0.21%May 15, 2026
- Critical9.1The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface.Check if you run itEPSS 0.41%May 12, 2026
- Medium6.5The Elasticsearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — i…Check if you run itEPSS 0.41%May 11, 2026
- Medium6.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.Check if you run itEPSS 0.14%Apr 27, 2026
- Medium6.1Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string.Check if you run itEPSS 0.19%Apr 24, 2026