Vendor
Elastic
396 known vulnerabilities.
Elastic at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 12 | 0 |
| Oct 2026 | 21 | 0 |
| Sep 2026 | 53 | 0 |
| Aug 2026 | 49 | 0 |
| Jul 2026 | 28 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 10 | 0 |
| Apr 2026 | 7 | 0 |
| Mar 2026 | 4 | 0 |
| Feb 2026 | 6 | 0 |
| Jan 2026 | 6 | 0 |
| Dec 2025 | 13 | 0 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 6 | 1 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 1 | 0 |
| Jul 2025 | 2 | 0 |
| Jun 2025 | 2 | 0 |
| May 2025 | 8 | 1 |
| Apr 2025 | 5 | 0 |
| Mar 2025 | 1 | 1 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 8 | 1 |
| Dec 2024 | 1 | 0 |
Products
Latest advisories
-
High max 8.6NCSC-2026-0078 5 CVEs
Kwetsbaarheden verholpen in Kibana
Elastic heeft kwetsbaarheden verholpen in Kibana.
-
High max 9.9NCSC-2025-0075 1 CVE
Kwetsbaarheid verholpen in Elastic Kibana
Elastic heeft een kwetsbaarheid verholpen in Kibana.
396 results · Feed
-
High 7.4
Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections
Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS …
-
Medium 6.5
Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to e…
-
Medium 6.5
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with per…
-
Medium 4.2
Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure
Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users wh…
-
Medium 4.3
Incorrect Authorization in Elasticsearch Leading to Information Disclosure
Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value…
-
Medium 6.5
NULL Pointer Dereference in Packetbeat Leading to Denial of Service
NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause…
-
Medium 4.3
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrie…
-
High 7.3
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent a…
-
Medium 6.5
Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure
Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Ki…
-
Medium 4.3
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kib…
-
High 7.5CVE-2026-115290 Public exploit
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted…
-
Medium 4.3
Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a diff…
-
High 7.5
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).
-
Medium 4.3
Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the pla…
-
Medium 6.4
Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform servic…
-
High 8.2
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).
-
High 7.2
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).
-
Medium 6.4
Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, da…
-
Medium 6.8
Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved fo…
-
High 7.1
Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypas…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontro…
-
High 7.2
Incorrect Authorization in Elasticsearch Leading to Privilege Escalation
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configu…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggr…
-
Medium 6.5
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of…
-
Medium 6.2
Uncaught Exception in Elastic Endpoint Leading to Denial of Service
Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, a…
-
Medium 6.5
Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive crede…
-
Medium 6.5
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, …
-
Medium 4.3
Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization che…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
-
Medium 4.3
Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressio…
-
Medium 5.4
Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the …
-
High 8.8
Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Ki…
-
Medium 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query proce…
-
Medium 4.9
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
-
Medium 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
-
Medium 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
-
Medium 6.5
Uncontrolled Resource Consumption in Kibana Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
-
Medium 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
-
Medium 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
-
Medium 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).