https://vulnogram.org/ Most recent CVEs assigned by Elastic (elastic). https://vulnogram.org/seaview/icons/elastic.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-103009 https://vulnogram.org/CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorizat… High Tue, 06 Oct 2026 19:31:53 GMT https://vulnogram.org/CVE-2026-103008 https://vulnogram.org/CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an… Medium Tue, 06 Oct 2026 19:31:51 GMT https://vulnogram.org/CVE-2026-103007 https://vulnogram.org/CVE-2026-103007 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in… High Tue, 06 Oct 2026 19:31:50 GMT https://vulnogram.org/CVE-2026-103006 https://vulnogram.org/CVE-2026-103006 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its se… Medium Tue, 06 Oct 2026 19:31:49 GMT https://vulnogram.org/CVE-2026-103005 https://vulnogram.org/CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled… Medium Tue, 06 Oct 2026 19:31:47 GMT https://vulnogram.org/CVE-2026-102413 https://vulnogram.org/CVE-2026-102413 Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Ja… Medium Tue, 06 Oct 2026 19:31:46 GMT https://vulnogram.org/CVE-2026-102412 https://vulnogram.org/CVE-2026-102412 Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensit… Medium Tue, 06 Oct 2026 19:31:44 GMT https://vulnogram.org/CVE-2026-102411 https://vulnogram.org/CVE-2026-102411 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template r… Medium Tue, 06 Oct 2026 19:31:43 GMT https://vulnogram.org/CVE-2026-102410 https://vulnogram.org/CVE-2026-102410 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authoriz… Medium Tue, 06 Oct 2026 19:31:41 GMT https://vulnogram.org/CVE-2026-102409 https://vulnogram.org/CVE-2026-102409 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130). Medium Tue, 06 Oct 2026 19:31:40 GMT https://vulnogram.org/CVE-2026-102408 https://vulnogram.org/CVE-2026-102408 Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular… Medium Tue, 06 Oct 2026 19:31:39 GMT https://vulnogram.org/CVE-2026-102407 https://vulnogram.org/CVE-2026-102407 Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could… Medium Tue, 06 Oct 2026 19:31:37 GMT https://vulnogram.org/CVE-2026-102406 https://vulnogram.org/CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or cus… High Tue, 06 Oct 2026 19:31:36 GMT https://vulnogram.org/CVE-2026-102404 https://vulnogram.org/CVE-2026-102404 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the qu… Medium Tue, 06 Oct 2026 19:31:34 GMT https://vulnogram.org/CVE-2026-94408 https://vulnogram.org/CVE-2026-94408 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Medium Sat, 26 Sep 2026 20:42:27 GMT https://vulnogram.org/CVE-2026-94397 https://vulnogram.org/CVE-2026-94397 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Medium Sat, 26 Sep 2026 20:42:25 GMT https://vulnogram.org/CVE-2026-94396 https://vulnogram.org/CVE-2026-94396 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Medium Sat, 26 Sep 2026 20:42:23 GMT https://vulnogram.org/CVE-2026-94400 https://vulnogram.org/CVE-2026-94400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) Medium Sat, 26 Sep 2026 20:42:21 GMT https://vulnogram.org/CVE-2026-94399 https://vulnogram.org/CVE-2026-94399 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Medium Sat, 26 Sep 2026 20:42:20 GMT https://vulnogram.org/CVE-2026-94398 https://vulnogram.org/CVE-2026-94398 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Medium Sat, 26 Sep 2026 20:42:18 GMT https://vulnogram.org/CVE-2026-82300 https://vulnogram.org/CVE-2026-82300 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Medium Sat, 26 Sep 2026 20:42:16 GMT https://vulnogram.org/CVE-2026-82294 https://vulnogram.org/CVE-2026-82294 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Medium Sat, 26 Sep 2026 20:42:15 GMT https://vulnogram.org/CVE-2026-78582 https://vulnogram.org/CVE-2026-78582 Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space… Medium Sat, 26 Sep 2026 20:42:13 GMT https://vulnogram.org/CVE-2026-72662 https://vulnogram.org/CVE-2026-72662 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Tim… Medium Sat, 26 Sep 2026 20:42:11 GMT https://vulnogram.org/CVE-2026-72668 https://vulnogram.org/CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a… High Sat, 26 Sep 2026 20:42:09 GMT https://vulnogram.org/CVE-2026-82302 https://vulnogram.org/CVE-2026-82302 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). High Thu, 03 Sep 2026 18:35:44 GMT https://vulnogram.org/CVE-2026-82299 https://vulnogram.org/CVE-2026-82299 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). Medium Thu, 03 Sep 2026 18:35:43 GMT https://vulnogram.org/CVE-2026-82298 https://vulnogram.org/CVE-2026-82298 Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). Medium Thu, 03 Sep 2026 18:35:42 GMT https://vulnogram.org/CVE-2026-78596 https://vulnogram.org/CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level… Medium Thu, 03 Sep 2026 18:35:40 GMT https://vulnogram.org/CVE-2026-78595 https://vulnogram.org/CVE-2026-78595 Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent p… Medium Thu, 03 Sep 2026 18:35:38 GMT https://vulnogram.org/CVE-2026-78593 https://vulnogram.org/CVE-2026-78593 An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasti… Medium Thu, 03 Sep 2026 18:35:37 GMT https://vulnogram.org/CVE-2026-78583 https://vulnogram.org/CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint cred… High Thu, 03 Sep 2026 18:35:36 GMT https://vulnogram.org/CVE-2026-82293 https://vulnogram.org/CVE-2026-82293 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learni… Medium Wed, 02 Sep 2026 14:43:29 GMT https://vulnogram.org/CVE-2026-78588 https://vulnogram.org/CVE-2026-78588 Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed re… Medium Wed, 02 Sep 2026 14:43:28 GMT https://vulnogram.org/CVE-2026-78587 https://vulnogram.org/CVE-2026-78587 Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing… Low Wed, 02 Sep 2026 14:43:26 GMT https://vulnogram.org/CVE-2026-78586 https://vulnogram.org/CVE-2026-78586 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana… Medium Wed, 02 Sep 2026 14:43:24 GMT https://vulnogram.org/CVE-2026-78584 https://vulnogram.org/CVE-2026-78584 Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled qu… Medium Wed, 02 Sep 2026 14:43:22 GMT https://vulnogram.org/CVE-2026-78591 https://vulnogram.org/CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent acti… Medium Wed, 02 Sep 2026 14:43:20 GMT https://vulnogram.org/CVE-2026-78590 https://vulnogram.org/CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Sett… High Wed, 02 Sep 2026 14:43:18 GMT https://vulnogram.org/CVE-2026-78599 https://vulnogram.org/CVE-2026-78599 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write… Medium Wed, 02 Sep 2026 14:43:17 GMT https://vulnogram.org/CVE-2026-78598 https://vulnogram.org/CVE-2026-78598 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job managemen… Medium Wed, 02 Sep 2026 14:43:15 GMT https://vulnogram.org/CVE-2026-78594 https://vulnogram.org/CVE-2026-78594 Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly c… Medium Wed, 02 Sep 2026 14:43:13 GMT https://vulnogram.org/CVE-2026-78604 https://vulnogram.org/CVE-2026-78604 Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the… High Wed, 02 Sep 2026 14:43:11 GMT https://vulnogram.org/CVE-2026-78602 https://vulnogram.org/CVE-2026-78602 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network c… Medium Network Exploitable Wed, 02 Sep 2026 14:43:09 GMT https://vulnogram.org/CVE-2026-78601 https://vulnogram.org/CVE-2026-78601 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kiba… Medium Wed, 02 Sep 2026 14:43:07 GMT https://vulnogram.org/CVE-2026-78600 https://vulnogram.org/CVE-2026-78600 Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a… Low Wed, 02 Sep 2026 14:43:06 GMT https://vulnogram.org/CVE-2026-78609 https://vulnogram.org/CVE-2026-78609 Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacke… Medium Wed, 02 Sep 2026 14:43:04 GMT https://vulnogram.org/CVE-2026-63138 https://vulnogram.org/CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially craft… Medium Tue, 01 Sep 2026 19:20:43 GMT https://vulnogram.org/CVE-2026-78597 https://vulnogram.org/CVE-2026-78597 Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature… Medium Tue, 01 Sep 2026 19:20:41 GMT https://vulnogram.org/CVE-2026-78592 https://vulnogram.org/CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges coul… High Tue, 01 Sep 2026 19:20:39 GMT