Skip to contentElastic Kibana vulnerabilities
- elastic kibanaPath Traversal in Kibana Leading to Unauthorized Deletion of User AccountsCVE-2026-33462Fix available4.6 Medium
- elastic kibanaServer-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information DisclosureCVE-2026-33458Fix available6.8 Medium
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of ServiceCVE-2026-33459Fix available6.5 Medium
- elastic kibanaIncorrect Authorization in Kibana Fleet Leading to Information DisclosureCVE-2026-33460Fix available4.3 Medium
- elastic kibanaIncorrect Authorization in Kibana Fleet Leading to Information DisclosureCVE-2026-33461Fix available7.7 High
- elastic kibanaExecution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scopeCVE-2026-4498Fix available7.7 High
- elastic kibanaImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of ServiceCVE-2026-269406.5 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Endpoint Response Action ConfigurationCVE-2026-269396.5 Medium
- elastic kibanaImproper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)CVE-2026-26938Fix available8.6 High
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of ServiceCVE-2026-26937Fix available6.5 Medium
- elastic kibanaInefficient Regular Expression Complexity in Kibana Leading to Denial of ServiceCVE-2026-26936Fix available4.9 Medium
- elastic kibanaImproper Input Validation in Kibana Leading to Denial of ServiceCVE-2026-26935Fix available6.5 Medium
- elastic kibanaImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of ServiceCVE-2026-26934Fix available6.5 Medium
- elastic kibana, red hat logging subsystem for red hat openshift, jboss enterprise application platform 8 +3 more +5 moreExternal Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini ConnectorCVE-2026-0532Fix available8.6 High
- elastic kibanaImproper Input Validation in Kibana Email Connector Leading to Excessive AllocationCVE-2026-0543Fix available6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana FleetCVE-2026-0531Fix available6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Excessive AllocationCVE-2026-0530Fix available6.5 Medium
- elastic metricbeat, kibana +1 moreImproper Input Validation in Metricbeat Leading to Denial of ServiceCVE-2026-0528Fix available6.5 Medium
- elastic kibanaKibana Improper AuthorizationCVE-2025-68422Fix available4.3 Medium
- elastic kibanaKibana Improper AuthorizationCVE-2025-68386Fix available4.3 Medium
- elastic kibanaKibana Allocation of Resources Without Limits or ThrottlingCVE-2025-68389Fix available6.5 Medium
- elastic kibanaKibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68387Fix available6.1 Medium
- elastic kibanaKibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68385Fix available7.2 High
- elastic kibanaKibana Cross-site Scripting via the Integration Package Upload FunctionalityCVE-2025-37732Fix available5.4 Medium
- elastic kibanaKibana Origin Validation ErrorCVE-2025-37734Fix available4.3 Medium
- elastic kibanaImproper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary...CVE-2025-377357.0 High
- elastic kibanaKibana Stored Cross-Site Scripting (XSS)CVE-2025-25017Fix available8.2 High
- elastic kibanaKibana Stored Cross-Site Scripting (XSS)CVE-2025-25018Fix available8.7 High
- elastic kibanaKibana Cross-Site Scripting (XSS)CVE-2025-25009Fix available8.7 High
- elastic kibanaKibana Insufficiently Protected Credentials in the CrowdStrike ConnectorCVE-2025-37728Fix available5.4 Medium
- elastic kibanaKibana privilege escalation via reporting_user roleCVE-2025-25010Fix available6.5 Medium
- elastic kibanaKibana Open RedirectCVE-2025-25012Fix available4.3 Medium
- elastic kibanaKibana Improper AuthorizationCVE-2024-43706Fix available7.6 High
- elastic kibanaKibana arbitrary code execution via prototype pollutionCVE-2025-25014Public exploitFix availableEPSS 22.3%9.1 Critical
- elastic kibanaKibana Unrestricted Upload of File with Dangerous Type Can Lead to XSSCVE-2024-11390Fix available5.4 Medium
- elastic kibanaKibana Unrestricted Upload of FileCVE-2025-25016Fix available4.3 Medium
- elastic kibanaKibana Prototype Pollution can lead to code injectionCVE-2024-12556Fix available8.7 High
- elastic kibanaAn issue has been identified where a specially crafted request sent to an Observability API could...CVE-2024-52974Fix available6.5 Medium
- elastic kibanaKibana arbitrary code execution via prototype pollutionCVE-2025-25015Fix available9.9 Critical
- elastic kibanaAn allocation of resources without limits or throttling in Kibana can lead to a crash caused by a...CVE-2024-43708Fix available6.5 Medium
- elastic kibanaKibana allocation of resources without limits or throttling leads to crashCVE-2024-52972Fix available6.5 Medium
- elastic kibanaKibana exposure of sensitive information to an unauthorized actorCVE-2024-43707Fix available7.7 High
- elastic kibanaKibana server-side request forgeryCVE-2024-43710Fix available4.3 Medium
- elastic kibanaKibana allocation of resources without limits or throttling leads to crashCVE-2024-529736.5 Medium
- elastic kibanaKibana arbitrary code execution via YAML deserializationCVE-2024-37285Fix available9.1 Critical
- elastic kibanaA deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to...CVE-2024-37288Fix available9.9 Critical
- elastic kibanaKibana arbitrary code execution via prototype pollutionCVE-2024-372879.1 Critical
- elastic kibanaKibana Denial of Service issueCVE-2024-37281Fix available6.5 Medium
- elastic kibanaA high-privileged user, allowed to create custom osquery packs 17 could affect the availability...CVE-2024-23443Public exploitFix available4.9 Medium
- elastic kibanaKibana open redirect issueCVE-2024-23442Fix available6.1 Medium
- Show moreLoading…