floragunn

Latest CVEs · RSS

• CVE-2026-4819 2026-03-31 · CVSS 4.9
  In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.
• CVE-2026-4818 2026-03-31 · CVSS 6.8
  In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operat
• CVE-2026-4799 2026-03-31 · CVSS 4.3
  In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.
• CVE-2025-13653 2025-12-01 · CVSS 4.3
  In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specia
• CVE-2025-12149 2025-11-14 · CVSS 6.0
  In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals
• CVE-2025-12148 2025-10-29 · CVSS 6.0
  In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fiel
• CVE-2025-12147 2025-10-29 · CVSS 6.0
  In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (
• CVE-2019-13422 2019-08-23
  Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon
• CVE-2019-13423 2019-08-23
  Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user whe
• CVE-2019-13421 2019-08-23
  Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal
• CVE-2019-13415 2019-08-13
  Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not author
• CVE-2019-13416 2019-08-13
  Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignor
• CVE-2019-13419 2019-08-13
  Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.
• CVE-2019-13420 2019-08-13
  Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.
• CVE-2019-13418 2019-08-12
  Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized.
• CVE-2019-13417 2019-08-12
  Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user w