Vulnerabilidades em Elastic

396 resultados
Análise Vexday

Com 233 CVEs catalogadas, o ecossistema Elastic apresenta taxa de exploração ativa em linha com a média geral do catálogo, o que não elimina pontos de atenção relevantes. O CVE-2019-7609, única entrada confirmada no CISA KEV, carrega EPSS de 0,9534 — valor extremamente elevado que indica alta probabilidade de exploração ativa e deve ser prioridade absoluta para equipes que ainda não aplicaram a correção correspondente. O tipo de falha mais frequente, CWE-79 (Cross-Site Scripting), sugere que controles de sanitização de entrada e saída merecem atenção sistemática no ciclo de desenvolvimento e hardening das implantações. As 17 CVEs surgidas nos últimos 90 dias e a existência de 3 vulnerabilidades com PoC pública reforçam a necessidade de monitoramento contínuo, especialmente em ambientes expostos.

CVE-2026-56149MEDIUMAllocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-78594MEDIUMImproper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of ServiceEPSS 0.5%CVE-2024-23446MEDIUMKibana Broken Access Control issueEPSS 0.5%CVE-2026-63137HIGHIncorrect Authorization in Kibana Leading to Privilege EscalationEPSS 0.5%CVE-2024-37286MEDIUMAPM Server Insertion of Sensitive Information into Log FileEPSS 0.5%CVE-2024-23451MEDIUMElasticsearch Incorrect Authorization in the Remote Cluster Security API key based security modelEPSS 0.5%CVE-2026-0532HIGHExternal Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini ConnectorEPSS 0.5%CVE-2026-0531MEDIUMAllocation of Resources Without Limits or Throttling in Kibana FleetEPSS 0.5%CVE-2026-72670HIGHExposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy CredentialsEPSS 0.5%CVE-2026-78599MEDIUMStored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal ResourcesEPSS 0.5%CVE-2026-56150MEDIUMAllocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of ServiceEPSS 0.5%CVE-2026-56151MEDIUMImproper Input Validation in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-72628MEDIUMImproper Handling of Highly Compressed Data in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-63261MEDIUMUncontrolled Resource Consumption in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-72682MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-49087MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-72679MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-72678MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-63263MEDIUMUncontrolled Resource Consumption in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-63260MEDIUMUncontrolled Resource Consumption in Kibana Leading to Denial of ServiceEPSS 0.5%