Elasticsearch vulnerabilities

Products

• Packetbeat 6
• Elasticsearch 4
• Kibana 3
• Logstash 3

Newest

• elastic packetbeat Improper Validation of Array Index in Packetbeat Leading to Denial of Service CVE-2026-26933 Fix available 5.7 MediumMarch 19, 2026
• elastic packetbeat Improper Validation of Array Index in Packetbeat Leading to Denial of Service CVE-2026-26932 5.7 MediumFebruary 26, 2026
• elastic packetbeat Packetbeat Out-of-bounds Read CVE-2025-68382 6.5 MediumDecember 18, 2025
• elastic packetbeat Packetbeat Improper Bounds Check CVE-2025-68381 6.5 MediumDecember 18, 2025
• elastic packetbeat Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments CVE-2025-68388 Fix available 5.3 MediumDecember 18, 2025
• elastic kibana, oracle communications billing and revenue management, communications cloud native core network function cloud native environment +1 more +3 more In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS... CVE-2020-7017 Fix available 6.7 MediumJuly 27, 2020
• elastic kibana, oracle communications billing and revenue management, communications cloud native core network function cloud native environment +1 more +3 more Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An... CVE-2020-7016 Fix available 4.8 MediumJuly 27, 2020
• elastic packetbeat Denial of Service in Packetbeat CVE-2017-11480 Fix available 7.5 HighDecember 8, 2017
• elastic cloud enterprise The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt... CVE-2017-8444 5.9 MediumSeptember 28, 2017
• elastic kibana Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that... CVE-2017-11479 6.1 MediumSeptember 28, 2017
• elasticsearch logstash The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1... CVE-2017-14730 7.8 HighSeptember 25, 2017
• elasticsearch x-pack, elastic x-pack reporting +1 more Improper Privilege Management in X-Pack CVE-2017-8446 Fix available 5.3 MediumAugust 18, 2017
• elastic logstash Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash... CVE-2015-5619 5.9 MediumAugust 9, 2017
• elasticsearch Improper Access Control in Elasticsearch CVE-2015-4165 Fix available 7.5 HighAugust 9, 2017
• elastic logstash Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications... CVE-2015-5378 7.5 HighJune 27, 2017
• elastic logstash, elasticsearch output plugin +1 more Logstash Logs Sensitive Information CVE-2016-10362 Fix available 6.5 MediumJune 16, 2017
• elasticsearch Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch CVE-2015-5531 Public exploitFix available EPSS 94.8% 5.0 MediumAugust 17, 2015
• elasticsearch Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch CVE-2015-3337 Public exploitFix available EPSS 33.2% 4.3 MediumApril 29, 2015
• elasticsearch Cross-site scripting in Elasticsearch CVE-2014-6439 Fix available 4.3 MediumOctober 10, 2014