Elasticsearch vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
77 matching records
- UnknownCGA-xxhr-gx23-53mqOpen the advisoryApr 18, 2026
- UnknownCGA-xxwp-595x-7554Open the advisoryApr 16, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.27%Apr 8, 2026
- High7.7Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure.Check if you run itEPSS 0.23%Apr 8, 2026
- High7.7Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope…Check if you run itEPSS 0.30%Apr 8, 2026
- Medium6.5Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122).Check if you run itEPSS 0.28%Apr 8, 2026
- Medium4.3Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122).Check if you run itEPSS 0.18%Apr 8, 2026
- Low2.0A vulnerability was determined in Dataease SQLbot up to 1.6.0.Check if you run itEPSS 0.23%Apr 2, 2026
- Medium6.5In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.Check if you run itEPSS 0.22%Mar 31, 2026
- Medium6.5Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130).Check if you run itEPSS 0.28%Mar 19, 2026
- Medium6.5Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, proc…Check if you run itEPSS 0.20%Mar 19, 2026
- Medium5.7Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153).Check if you run itEPSS 0.25%Mar 19, 2026
- Medium4.6ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary H…Check if you run itEPSS 0.29%Mar 12, 2026
- UnknownCGA-xxxg-9xq8-9vh7Open the advisoryMar 6, 2026
- UnknownCGA-xxpx-59pj-mqfcOpen the advisoryMar 3, 2026
- High7.7Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files fr…Check if you run itEPSS 0.29%Feb 26, 2026
- High7.5Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)Check if you run itEPSS 0.32%Feb 26, 2026
- High7.5Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential B…Check if you run itEPSS 0.37%Feb 26, 2026
- High7.5Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)Check if you run itEPSS 0.32%Feb 26, 2026
- Medium6.5Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via…Check if you run itEPSS 0.32%Feb 26, 2026
- High7.5Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153).Check if you run itEPSS 0.51%Feb 26, 2026
- High8.6External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafCheck if you run itEPSS 0.49%Jan 14, 2026
- Medium6.5Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameteCheck if you run itEPSS 0.43%Jan 13, 2026
- Medium6.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request.Check if you run itEPSS 0.49%Jan 13, 2026
- Medium6.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request.Check if you run itEPSS 0.33%Jan 13, 2026