Skip to content
OpenAdvisories

Vendor

Elastic

396 known vulnerabilities.

Products

Kibana 196 Elasticsearch 91 Elastic Cloud Enterprise 13 Logstash 9 Apm Server 8 Packetbeat 8 Fleet Server 7 Elastic X-Pack Security 6 Elastic Agent 5 Eck Operator 4 Beats 3 Elastic Cloud Enterprise (ECE) 3 Filebeat 3 X-Pack Security 3 Elastic Enterprise Search 3 Elastic Endpoint Security 2 Elasticsearch X-Pack Machine Learning 2 Elastic Cloud on Kubernetes 2 Elastic App Search 2 Metricbeat 2 Elastic Agent and Elastic Defend 2 Elastic Defend 2 Elastic APM Agent for Go 1 Enterprise Search 1 Elastic Network Drive Connector 1 Elastic X-Pack Alerting 1 Kibana X-Pack Security 1 Elastic Package Registry 1 Elastic Endpoint Security and Elastic Endgame Security 1 Enterprisesearch 1 Endpoint 1 Elasticsearch-Hadoop 1 Elastic APM Java Agent 1 APM Java Agent 1 Elastic Code 1 Endpoint Security 1 Elastic APM agent for Python 1 Elastic APM agent for Ruby 1 Elastic Docker images 1 Elastic APM .NET Agent 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-37729

    Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine

    Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variab…

    Elastic Elastic Cloud Enterprise (ECE)
  • Critical 9.1
    CVE-2025-25014 Public exploit EPSS 22%

    Kibana arbitrary code execution via prototype pollution

    A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

    Elastic Kibana
  • Critical 9.9
    CVE-2025-25015

    Kibana arbitrary code execution via prototype pollution

    Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.…

    Elastic Kibana
  • Critical 9.0
    CVE-2024-52975

    Fleet Server sensitive information exposure via logs

    An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends on the integrations enabled.

    Elastic Fleet Server
  • Critical 9.1
    CVE-2024-37285

    Kibana arbitrary code execution via YAML deserialization

    A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privi…

    Elastic Kibana
  • Critical 9.9
    CVE-2024-37288

    A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document co…

    Elastic Kibana
  • Critical 9.1
    CVE-2024-37287

    Kibana arbitrary code execution via prototype pollution

    A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary c…

    Elastic Kibana
  • Critical 9.0
    CVE-2023-31422

    Kibana Insertion of Sensitive Information into Log File

    An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta patter…

    Elastic Kibana
  • Critical 9.9
    CVE-2023-31415

    Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetic…

    Elastic Kibana
  • Critical 9.8
    CVE-2019-7609 Exploited Public exploit Scanner template EPSS 95%

    Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacke…

    Elastic Kibana
    KEV Jan 10, 2022