Export limit exceeded: 380895 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 380895 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (320 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-12556 | 1 Elastic | 1 Kibana | 2026-02-26 | 8.7 High |
| Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. | ||||
| CVE-2025-25010 | 1 Elastic | 1 Kibana | 2026-02-26 | 6.5 Medium |
| Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces. | ||||
| CVE-2025-25018 | 1 Elastic | 1 Kibana | 2026-02-26 | 8.7 High |
| Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) | ||||
| CVE-2025-37729 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-02-26 | 9.1 Critical |
| Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated. | ||||
| CVE-2025-37736 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-02-26 | 8.8 High |
| Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{user_id} patch:/platform/configuration/security/service-accounts/{user_id} post:/platform/configuration/security/service-accounts/{user_id}/keys delete:/platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id} patch:/user post:/users post:/users/auth/keys delete:/users/auth/keys delete:/users/auth/keys/_all delete:/users/auth/keys/{api_key_id} delete:/users/{user_id}/auth/keys delete:/users/{user_id}/auth/keys/{api_key_id} delete:/users/{user_name} patch:/users/{user_name} | ||||
| CVE-2025-37731 | 1 Elastic | 1 Elasticsearch | 2026-02-26 | 6.8 Medium |
| Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority. | ||||
| CVE-2024-37282 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-01-30 | 8.1 High |
| It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated privileges. | ||||
| CVE-2025-68422 | 1 Elastic | 1 Kibana | 2025-12-23 | 4.3 Medium |
| Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries. | ||||
| CVE-2025-68389 | 1 Elastic | 1 Kibana | 2025-12-23 | 6.5 Medium |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request. | ||||
| CVE-2025-68386 | 1 Elastic | 1 Kibana | 2025-12-23 | 4.3 Medium |
| Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request. | ||||
| CVE-2025-68387 | 1 Elastic | 1 Kibana | 2025-12-23 | 6.1 Medium |
| Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator. | ||||
| CVE-2025-68385 | 1 Elastic | 1 Kibana | 2025-12-23 | 7.2 High |
| Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation. | ||||
| CVE-2025-68383 | 1 Elastic | 1 Filebeat | 2025-12-23 | 6.5 Medium |
| Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration. | ||||
| CVE-2025-68384 | 1 Elastic | 1 Elasticsearch | 2025-12-23 | 6.5 Medium |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data. | ||||
| CVE-2025-68390 | 1 Elastic | 1 Elasticsearch | 2025-12-23 | 4.9 Medium |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request. | ||||
| CVE-2025-68388 | 2 Elastic, Elasticsearch | 2 Packetbeat, Packetbeat | 2025-12-23 | 5.3 Medium |
| Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat. | ||||
| CVE-2025-68382 | 2 Elastic, Elasticsearch | 2 Packetbeat, Packetbeat | 2025-12-23 | 6.5 Medium |
| Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service (DoS) through a reliable process crash when handling truncated XDR-encoded RPC messages. | ||||
| CVE-2025-68381 | 2 Elastic, Elasticsearch | 2 Packetbeat, Packetbeat | 2025-12-23 | 6.5 Medium |
| Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number. | ||||
| CVE-2025-37727 | 1 Elastic | 1 Elasticsearch | 2025-12-23 | 5.7 Medium |
| Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex | ||||
| CVE-2025-37732 | 1 Elastic | 1 Kibana | 2025-12-18 | 5.4 Medium |
| Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection. | ||||