Filtered by vendor Elastic
Subscribe
Total
370 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-37727 | 1 Elastic | 1 Elasticsearch | 2026-10-08 | N/A | 5.7 MEDIUM |
| Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex | |||||
| CVE-2025-25018 | 1 Elastic | 1 Kibana | 2026-10-08 | N/A | 8.7 HIGH |
| Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) | |||||
| CVE-2025-25017 | 1 Elastic | 1 Kibana | 2026-10-08 | N/A | 8.2 HIGH |
| Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) | |||||
| CVE-2025-37729 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-08 | N/A | 9.1 CRITICAL |
| Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated. | |||||
| CVE-2025-37736 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-07 | N/A | 8.8 HIGH |
| Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{user_id} patch:/platform/configuration/security/service-accounts/{user_id} post:/platform/configuration/security/service-accounts/{user_id}/keys delete:/platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id} patch:/user post:/users post:/users/auth/keys delete:/users/auth/keys delete:/users/auth/keys/_all delete:/users/auth/keys/{api_key_id} delete:/users/{user_id}/auth/keys delete:/users/{user_id}/auth/keys/{api_key_id} delete:/users/{user_name} patch:/users/{user_name} | |||||
| CVE-2025-37732 | 1 Elastic | 1 Kibana | 2026-10-07 | N/A | 5.4 MEDIUM |
| Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection. | |||||
| CVE-2025-37731 | 1 Elastic | 1 Elasticsearch | 2026-10-07 | N/A | 6.8 MEDIUM |
| Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority. | |||||
| CVE-2026-94408 | 1 Elastic | 1 Elasticsearch | 2026-10-06 | N/A | 4.9 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |||||
| CVE-2026-82300 | 1 Elastic | 1 Elasticsearch | 2026-10-01 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | |||||
| CVE-2025-68384 | 1 Elastic | 1 Elasticsearch | 2026-09-30 | N/A | 6.5 MEDIUM |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data. | |||||
| CVE-2026-94397 | 1 Elastic | 1 Elasticsearch | 2026-09-29 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |||||
| CVE-2026-94398 | 1 Elastic | 1 Elasticsearch | 2026-09-29 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |||||
| CVE-2026-94399 | 1 Elastic | 1 Elasticsearch | 2026-09-29 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |||||
| CVE-2026-94400 | 1 Elastic | 1 Kibana | 2026-09-29 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) | |||||
| CVE-2026-94396 | 1 Elastic | 1 Elasticsearch | 2026-09-29 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |||||
| CVE-2026-82294 | 1 Elastic | 1 Elasticsearch | 2026-09-29 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | |||||
| CVE-2026-78602 | 1 Elastic | 1 Maps Server | 2026-09-08 | N/A | 5.3 MEDIUM |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process. | |||||
| CVE-2026-78583 | 1 Elastic | 1 Kibana | 2026-09-08 | N/A | 8.1 HIGH |
| Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration. | |||||
| CVE-2026-72676 | 1 Elastic | 1 Kibana | 2026-09-04 | N/A | 6.5 MEDIUM |
| Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data. | |||||
| CVE-2026-72672 | 1 Elastic | 1 Kibana | 2026-09-04 | N/A | 7.7 HIGH |
| The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts. | |||||