[ Vendor · 28 CVEs ]
Elastic
CVEs affecting Elastic published in the last 30 days, plus any Elastic CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103008 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchUncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct… | |
| CVE-2026-103009 | 6 Oct 2026 | CVSS 7.1 | ElasticsearchAuthorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster… | |
| CVE-2026-102410 | 6 Oct 2026 | CVSS 4.3 | Elastic KibanaMissing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1)… | |
| CVE-2026-102411 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchAllocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130)… | |
| CVE-2026-102412 | 6 Oct 2026 | CVSS 6.5 | Elastic KibanaIncorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs… | |
| CVE-2026-102413 | 6 Oct 2026 | CVSS 6.2 | Elastic Agent and Elastic DefendUncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic… | |
| CVE-2026-103005 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchMemory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An… | |
| CVE-2026-103006 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchUncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the… | |
| CVE-2026-103007 | 6 Oct 2026 | CVSS 7.2 | ElasticsearchIncorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully… | |
| CVE-2026-102404 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged… | |
| CVE-2026-102406 | 6 Oct 2026 | CVSS 8.8 | Elastic KibanaAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers… | |
| CVE-2026-102407 | 6 Oct 2026 | CVSS 5.4 | ElasticsearchIncorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly… | |
| CVE-2026-102408 | 6 Oct 2026 | CVSS 4.3 | ElasticsearchInefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup… | |
| CVE-2026-102409 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchUncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting… | |
| CVE-2026-94396 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94397 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94398 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94399 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94400 | 26 Sep 2026 | CVSS 6.5 | Elastic KibanaUncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94408 | 26 Sep 2026 | CVSS 4.9 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-72662 | 26 Sep 2026 | CVSS 6.3 | Elastic KibanaAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via… | |
| CVE-2026-72668 | 26 Sep 2026 | CVSS 7.3 | Elastic KibanaUnintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user… | |
| CVE-2026-78582 | 26 Sep 2026 | CVSS 6.5 | Elastic KibanaMissing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-82294 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | |
| CVE-2026-82300 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | |
| CVE-2019-7609 | 25 Mar 2019 | CVSS 10.0 | Kibana Arbitrary Code ExecutionKibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion… | Exploited |
| CVE-2015-1427 | 17 Feb 2015 | CVSS 9.8 | Elasticsearch Groovy Scripting Engine Remote Code ExecutionThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism… | ExploitedFix |
| CVE-2014-3120 | 28 Jul 2014 | CVSS 8.1 | Elasticsearch Remote Code ExecutionThe default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions… | Exploited |