Skip to content
OpenAdvisories

Vendor

Elastic

396 known vulnerabilities.

Products

Kibana 196 Elasticsearch 91 Elastic Cloud Enterprise 13 Logstash 9 Apm Server 8 Packetbeat 8 Fleet Server 7 Elastic X-Pack Security 6 Elastic Agent 5 Eck Operator 4 Beats 3 Elastic Cloud Enterprise (ECE) 3 Filebeat 3 X-Pack Security 3 Elastic Enterprise Search 3 Elastic Endpoint Security 2 Elasticsearch X-Pack Machine Learning 2 Elastic Cloud on Kubernetes 2 Elastic App Search 2 Metricbeat 2 Elastic Agent and Elastic Defend 2 Elastic Defend 2 Elastic APM Agent for Go 1 Enterprise Search 1 Elastic Network Drive Connector 1 Elastic X-Pack Alerting 1 Kibana X-Pack Security 1 Elastic Package Registry 1 Elastic Endpoint Security and Elastic Endgame Security 1 Enterprisesearch 1 Endpoint 1 Elasticsearch-Hadoop 1 Elastic APM Java Agent 1 APM Java Agent 1 Elastic Code 1 Endpoint Security 1 Elastic APM agent for Python 1 Elastic APM agent for Ruby 1 Elastic Docker images 1 Elastic APM .NET Agent 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.5
    CVE-2026-115290 Public exploit

    Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted…

    Elastic Elasticsearch
  • Critical 9.1
    CVE-2025-25014 Public exploit EPSS 22%

    Kibana arbitrary code execution via prototype pollution

    A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

    Elastic Kibana
  • Medium 4.9
    CVE-2024-23443 Public exploit

    A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading …

    Elastic Kibana
  • Medium 6.5
    CVE-2023-31419 Public exploit EPSS 61%

    Elasticsearch StackOverflow vulnerability

    A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Medium 6.5
    CVE-2021-22145 Public exploit EPSS 76%

    Generation of Error Message Containing Sensitive Information in Elasticsearch

    A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing p…

    Elastic Elasticsearch elasticsearch org.elasticsearch.client:elasticsearch-rest-client Ubuntu Maven
  • Unscored —
    CVE-2020-7012 Public exploit EPSS 18%

    Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authe…

    Elastic Kibana
  • Unscored —
    CVE-2019-7616 Public exploit

    Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration fo…

    Elastic Kibana
  • Critical 9.8
    CVE-2019-7609 Exploited Public exploit EPSS 95%

    Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacke…

    Elastic Kibana
    KEV Jan 10, 2022
  • Unscored —
    CVE-2018-17246 Public exploit EPSS 84%

    Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker wit…

    Elastic Kibana