Filtered by vendor Elastic
Subscribe
Total
238 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-68387 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.1 MEDIUM |
| Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator. | |||||
| CVE-2025-68386 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 4.3 MEDIUM |
| Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request. | |||||
| CVE-2025-68385 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 7.2 HIGH |
| Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation. | |||||
| CVE-2025-68384 | 1 Elastic | 1 Elasticsearch | 2026-06-17 | N/A | 6.5 MEDIUM |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data. | |||||
| CVE-2025-68383 | 1 Elastic | 1 Filebeat | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration. | |||||
| CVE-2025-37736 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-06-17 | N/A | 8.8 HIGH |
| Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{user_id} patch:/platform/configuration/security/service-accounts/{user_id} post:/platform/configuration/security/service-accounts/{user_id}/keys delete:/platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id} patch:/user post:/users post:/users/auth/keys delete:/users/auth/keys delete:/users/auth/keys/_all delete:/users/auth/keys/{api_key_id} delete:/users/{user_id}/auth/keys delete:/users/{user_id}/auth/keys/{api_key_id} delete:/users/{user_name} patch:/users/{user_name} | |||||
| CVE-2025-37734 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 4.3 MEDIUM |
| Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. | |||||
| CVE-2025-37732 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 5.4 MEDIUM |
| Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection. | |||||
| CVE-2025-37731 | 1 Elastic | 1 Elasticsearch | 2026-06-17 | N/A | 6.8 MEDIUM |
| Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority. | |||||
| CVE-2025-37729 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-06-17 | N/A | 9.1 CRITICAL |
| Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated. | |||||
| CVE-2025-37727 | 1 Elastic | 1 Elasticsearch | 2026-06-17 | N/A | 5.7 MEDIUM |
| Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex | |||||
| CVE-2025-25018 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 8.7 HIGH |
| Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) | |||||
| CVE-2025-25017 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 8.2 HIGH |
| Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) | |||||
| CVE-2025-25016 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 4.3 MEDIUM |
| Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation. | |||||
| CVE-2025-25015 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 9.9 CRITICAL |
| Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors | |||||
| CVE-2025-25014 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 9.1 CRITICAL |
| A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. | |||||
| CVE-2025-25012 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 4.3 MEDIUM |
| URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. | |||||
| CVE-2025-25010 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces. | |||||
| CVE-2025-25009 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 8.7 HIGH |
| Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. | |||||
| CVE-2024-52981 | 1 Elastic | 1 Elasticsearch | 2026-06-17 | N/A | 4.9 MEDIUM |
| An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow. | |||||