Filtered by vendor Elastic
Subscribe
Total
370 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-115711 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-30 | N/A | 6.4 MEDIUM |
| Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token. | |||||
| CVE-2026-115709 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-30 | N/A | 8.2 HIGH |
| Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132). | |||||
| CVE-2026-115708 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-30 | N/A | 7.2 HIGH |
| Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132). | |||||
| CVE-2026-115707 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-30 | N/A | 6.4 MEDIUM |
| Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages. | |||||
| CVE-2026-115706 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-30 | N/A | 6.8 MEDIUM |
| Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages. | |||||
| CVE-2026-115712 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-30 | N/A | 4.3 MEDIUM |
| Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change. | |||||
| CVE-2026-115713 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-30 | N/A | 7.5 HIGH |
| Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132). | |||||
| CVE-2024-14047 | 1 Elastic | 1 Winlogbeat | 2026-10-27 | N/A | 7.2 HIGH |
| A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service. | |||||
| CVE-2026-56148 | 1 Elastic | 1 Elasticsearch | 2026-10-25 | N/A | 6.5 MEDIUM |
| Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable. | |||||
| CVE-2026-56149 | 1 Elastic | 1 Elasticsearch | 2026-10-25 | N/A | 4.9 MEDIUM |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable. | |||||
| CVE-2026-49091 | 1 Elastic | 1 Kibana | 2026-10-25 | N/A | 8.0 HIGH |
| Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data. | |||||
| CVE-2026-56150 | 1 Elastic | 1 Fleet Server | 2026-10-25 | N/A | 6.5 MEDIUM |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable. | |||||
| CVE-2026-56152 | 1 Elastic | 1 Endpoint Security | 2026-10-25 | N/A | 5.3 MEDIUM |
| Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view. | |||||
| CVE-2026-49087 | 1 Elastic | 1 Kibana | 2026-10-25 | N/A | 6.5 MEDIUM |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable. | |||||
| CVE-2026-56151 | 1 Elastic | 1 Kibana | 2026-10-25 | N/A | 6.5 MEDIUM |
| Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality unavailable. | |||||
| CVE-2026-49090 | 1 Elastic | 1 Elasticsearch | 2026-10-25 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests. | |||||
| CVE-2026-49088 | 1 Elastic | 1 Kibana | 2026-10-25 | N/A | 4.4 MEDIUM |
| Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access. | |||||
| CVE-2026-56145 | 1 Elastic | 1 Elasticsearch | 2026-10-24 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash. | |||||
| CVE-2026-42397 | 1 Elastic | 1 Kibana | 2026-10-24 | N/A | 6.5 MEDIUM |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive resource consumption, which may render Kibana unavailable. | |||||
| CVE-2026-56146 | 1 Elastic | 1 Kibana | 2026-10-24 | N/A | 5.4 MEDIUM |
| Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope. | |||||