Skip to contentElastic Elasticsearch vulnerabilities
- elastic elasticsearchElasticsearch Improper AuthenticationCVE-2025-37731Fix available6.8 Medium
- elastic elasticsearchElasticsearch Insertion of sensitive information in log fileCVE-2025-37727Fix available5.7 Medium
- elastic elasticsearchElasticsearch Uncontrolled Resource Consumption vulnerabilityCVE-2024-52979Fix available6.5 Medium
- elastic elasticsearchElasticsearch Vulnerable to Stack Overflow due to a Large RecursionCVE-2024-52981Fix available4.9 Medium
- elastic elasticsearchElasticsearch Uncontrolled Resource Consumption vulnerabilityCVE-2024-52980Fix available6.5 Medium
- elastic elasticsearchElasticsearch allocation of resources without limits or throttling leads to crashCVE-2024-43709Fix available6.5 Medium
- elastic elasticsearchElasticsearch Incorrect AuthorizationCVE-2024-12539Fix available6.0 Medium
- elastic elasticsearchElasticsearch elasticsearch-certutil csr fails to encrypt private keyCVE-2024-23444Fix available4.9 Medium
- elastic elasticsearchElasticsearch Insertion of Sensitive Information into Log FileCVE-2023-49921Fix available5.2 Medium
- elastic elasticsearchElasticsearch StackOverflow vulnerabilityCVE-2024-37280Fix available4.9 Medium
- elastic elasticsearchElasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictionsCVE-2024-23445Fix available6.5 Medium
- elastic elasticsearchElasticsearch Uncaught ExceptionCVE-2024-23449Fix available4.3 Medium
- elastic elasticsearchElasticsearch Incorrect Authorization in the Remote Cluster Security API key based security modelCVE-2024-23451Fix available4.4 Medium
- elastic elasticsearchElasticsearch Uncontrolled Resource Consumption vulnerabilityCVE-2024-23450Fix available4.9 Medium
- elastic elasticsearch, elasticsearch-hadoop +1 moreElasticsearch-hadoop Unsafe DeserializationCVE-2023-46674Fix available6.0 Medium
- elastic elasticsearchElasticsearch Improper Handling of Exceptional ConditionsCVE-2023-46673Fix available6.5 Medium
- elastic elasticsearchElasticsearch privilege escalationCVE-2021-37937Fix available5.9 Medium
- elastic elasticsearchElasticsearch Insertion of sensitive information in audit logsCVE-2023-31417Fix available4.1 Medium
- elastic elasticsearch, cloud enterprise +1 moreElasticsearch uncontrolled resource consumptionCVE-2023-31418Fix available7.5 High
- elastic elasticsearchElasticsearch StackOverflow vulnerabilityCVE-2023-31419Public exploitFix availableEPSS 61.1%6.5 Medium
- elastic elasticsearchImproper Check for Unusual or Exceptional Conditions in ElasticsearchCVE-2022-23712Fix available7.5 High
- elastic elasticsearchElasticsearch privilege escalationCVE-2022-23708Fix available4.3 Medium
- elastic elasticsearchExposure of sensitive information in ElasticsearchCVE-2021-22147Fix available6.5 Medium
- elastic elasticsearch, oracle communications cloud native core automated test suite +1 moreDenial of Service in ElasticsearchCVE-2021-22144Fix available6.5 Medium
- elastic elasticsearchAll versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by...CVE-2021-22146Public exploitFix availableEPSS 35.8%7.5 High
- elastic elasticsearch, oracle communications cloud native core automated test suite +1 moreGeneration of Error Message Containing Sensitive Information in ElasticsearchCVE-2021-22145Public exploitFix availableEPSS 76.2%6.5 Medium
- elastic logstash, elasticsearch +1 moreIn Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw...CVE-2021-22138Fix available3.7 Low
- elastic elasticsearchExposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2021-22137Fix available5.3 Medium
- elastic elasticsearchAPI information disclosure flaw in ElasticsearchCVE-2021-22135Fix available5.3 Medium
- elastic elasticsearch, oracle communications cloud native core automated test suite +1 moreExposure of Sensitive Information to an Unauthorized ActorCVE-2021-22134Fix available4.3 Medium
- elastic elasticsearchInsertion of Sensitive Information into Log File in ElasticsearchCVE-2020-7021Fix available4.9 Medium
- elastic elasticsearch, oracle communications cloud native core automated test suite +1 moreInsufficiently Protected Credentials in ElasticsearchCVE-2021-22132Fix available4.8 Medium
- elastic elasticsearchPrivilege Context Switching Error in ElasticsearchCVE-2020-7020Fix available3.1 Low
- elastic elasticsearchImproper privilege management in elasticsearchCVE-2020-7019Fix available6.5 Medium
- elastic elasticsearchPrivilege Escalation Flaw in ElasticsearchCVE-2020-7014Fix available8.8 High
- elastic elasticsearchImproper Privilege Management in ElasticsearchCVE-2020-7009Fix available8.8 High
- elastic elasticsearchExposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2019-7619Fix available5.3 Medium
- elastic elasticsearchConcurrent Execution using Shared Resource with Improper Synchronization in ElasticsearchCVE-2019-7614Fix available5.9 Medium
- elastic elasticsearchImproper Access Control in ElasticsearchCVE-2019-7611Fix available8.1 High
- elastic elasticsearchImproper Restriction of XML External Entity Reference in ElasticsearchCVE-2018-17247Fix available5.9 Medium
- elastic elasticsearchExposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2018-17244Fix available6.5 Medium
- elastic elasticsearchExposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2018-3831Fix available8.8 High
- elastic elasticsearch, azure repository +1 moreA sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly...CVE-2018-38278.1 High
- elastic elasticsearchIn Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API....CVE-2018-38266.5 Medium
- elastic elasticsearch x-pack machine learning, elasticsearch x-pack, kibana x-pack +1 more +3 moreElasticsearch subject to cross site scriptingCVE-2018-3824Fix available6.1 Medium
- elastic elasticsearch x-pack machine learning, elasticsearch x-pack, kibana x-pack +1 more +3 moreX-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS)...CVE-2018-38235.4 Medium
- elastic elasticsearch** DISPUTED ** Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via...CVE-2015-5377Public exploitDisputedEPSS 14.4%9.8 Critical
- elastic elasticsearch x-pack security, x-pack +1 moreElasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the...CVE-2017-84426.5 Medium
- elastic elasticsearch, redhat fuse +1 moreImproper Access Control in ElasticsearchCVE-2015-1427In KEVPublic exploitFix availableEPSS 99.9%9.8 Critical
- elastic elasticsearchElasticsearch Improper Access Control vulnerabilityCVE-2014-3120In KEVPublic exploitFix availableEPSS 88.6%8.1 High