CVE Program partner

elastic

Elastic

API
CVEs, 365 days193407 all time, 27 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationElastic
RoleCNA
TypeVendor
Reports tomitre
ScopeElasticsearch, Kibana, Beats, Logstash, X-Pack, and Elastic Cloud Enterprise products only.
Advisorieshttps://www.elastic.co/community/security

Latest CVEs · RSS

  • CVE-2026-103009 2026-10-06 · CVSS 7.1
    Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search requ
  • CVE-2026-103008 2026-10-06 · CVSS 6.5
    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process
  • CVE-2026-103007 2026-10-06 · CVSS 7.2
    Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced d
  • CVE-2026-103006 2026-10-06 · CVSS 6.5
    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feat
  • CVE-2026-103005 2026-10-06 · CVSS 6.5
    Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user
  • CVE-2026-102413 2026-10-06 · CVSS 6.2
    Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint compone
  • CVE-2026-102412 2026-10-06 · CVSS 6.5
    Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).
  • CVE-2026-102411 2026-10-06 · CVSS 6.5
    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearc
  • CVE-2026-102410 2026-10-06 · CVSS 4.3
    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal
  • CVE-2026-102409 2026-10-06 · CVSS 6.5
    Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of
  • CVE-2026-102408 2026-10-06 · CVSS 4.3
    Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The E
  • CVE-2026-102407 2026-10-06 · CVSS 5.4
    Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACL
  • CVE-2026-102406 2026-10-06 · CVSS 8.8
    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or
  • CVE-2026-102404 2026-10-06 · CVSS 6.5
    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated
  • CVE-2026-94408 2026-09-26 · CVSS 4.9
    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • CVE-2026-94397 2026-09-26 · CVSS 6.5
    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • CVE-2026-94396 2026-09-26 · CVSS 6.5
    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • CVE-2026-94400 2026-09-26 · CVSS 6.5
    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
  • CVE-2026-94399 2026-09-26 · CVSS 6.5
    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • CVE-2026-94398 2026-09-26 · CVSS 6.5
    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • CVE-2026-82300 2026-09-26 · CVSS 6.5
    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
  • CVE-2026-82294 2026-09-26 · CVSS 6.5
    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
  • CVE-2026-78582 2026-09-26 · CVSS 6.5
    Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-
  • CVE-2026-72662 2026-09-26 · CVSS 6.3
    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Funct
  • CVE-2026-72668 2026-09-26 · CVSS 7.3
    Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit

All CVE Program partners