Vulnerabilities in Elastic
396 resultsCVE-2024-52981MEDIUMAn issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection oEPSS 0.6%CVE-2021-22141MEDIUMAn open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could EPSS 0.6%CVE-2023-6687MEDIUMElastic Agent Insertion of Sensitive Information into Log FileEPSS 0.6%CVE-2017-8444—The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is ablEPSS 0.6%CVE-2026-72686MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.6%CVE-2026-72683MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.6%CVE-2024-12556HIGHKibana Prototype Pollution can lead to code injectionEPSS 0.6%CVE-2024-37283MEDIUMElastic Agent Insertion of Sensitive Information into Log FileEPSS 0.6%CVE-2024-52980MEDIUMElasticsearch Uncontrolled Resource Consumption vulnerabilityEPSS 0.6%CVE-2026-78602MEDIUMImproper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File DisclosureEPSS 0.6%CVE-2026-33466HIGHImproper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File WriteEPSS 0.6%CVE-2022-23709—A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilegEPSS 0.6%CVE-2026-72676MEDIUMImproper Control of Generation of Code in Fleet Server Leading to Code InjectionEPSS 0.5%CVE-2021-22133—The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an applicatioEPSS 0.5%CVE-2022-23707—An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index paEPSS 0.5%CVE-2026-72660MEDIUMUncaught Exception in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2022-38779—An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciouslyEPSS 0.5%CVE-2026-26932MEDIUMImproper Validation of Array Index in Packetbeat Leading to Denial of ServiceEPSS 0.5%CVE-2026-72654MEDIUMExecution with Unnecessary Privileges in Kibana Leading to Information DisclosureEPSS 0.5%CVE-2021-37936MEDIUMIt was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the abEPSS 0.5%