Vulnerabilidades em Elastic

396 resultados
Análise Vexday

Com 233 CVEs catalogadas, o ecossistema Elastic apresenta taxa de exploração ativa em linha com a média geral do catálogo, o que não elimina pontos de atenção relevantes. O CVE-2019-7609, única entrada confirmada no CISA KEV, carrega EPSS de 0,9534 — valor extremamente elevado que indica alta probabilidade de exploração ativa e deve ser prioridade absoluta para equipes que ainda não aplicaram a correção correspondente. O tipo de falha mais frequente, CWE-79 (Cross-Site Scripting), sugere que controles de sanitização de entrada e saída merecem atenção sistemática no ciclo de desenvolvimento e hardening das implantações. As 17 CVEs surgidas nos últimos 90 dias e a existência de 3 vulnerabilidades com PoC pública reforçam a necessidade de monitoramento contínuo, especialmente em ambientes expostos.

CVE-2026-72628MEDIUMImproper Handling of Highly Compressed Data in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-63261MEDIUMUncontrolled Resource Consumption in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-56151MEDIUMImproper Input Validation in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-56148MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-49089MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-78586MEDIUMAllocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-72665HIGHMissing Authorization in Kibana Leading to Unauthorized Execution of Host Response ActionsEPSS 0.5%CVE-2026-63138MEDIUMImproper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information DisclosureEPSS 0.5%CVE-2024-12539MEDIUMElasticsearch Incorrect AuthorizationEPSS 0.5%CVE-2021-22138—In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When spEPSS 0.5%CVE-2025-68381MEDIUMPacketbeat Improper Bounds CheckEPSS 0.5%CVE-2021-37939—It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, whichEPSS 0.5%CVE-2024-23445MEDIUMElasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictionsEPSS 0.5%CVE-2023-49921MEDIUMAn issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw cEPSS 0.4%CVE-2024-43706HIGHKibana Improper AuthorizationEPSS 0.4%CVE-2025-25012MEDIUMKibana Open RedirectEPSS 0.4%CVE-2023-46666MEDIUMElastic Sharepoint Online Python Connector Improper Access ControlEPSS 0.4%CVE-2026-56143MEDIUMAllocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-72681MEDIUMMissing Authorization in Kibana Leading to Privilege Escalation and Information DisclosureEPSS 0.4%CVE-2026-0543MEDIUMImproper Input Validation in Kibana Email Connector Leading to Excessive AllocationEPSS 0.4%