https://vulnogram.org/ Most recent CVEs assigned by floragunn GmbH (floragunn). https://vulnogram.org/seaview/icons/floragunn.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-4819 https://vulnogram.org/CVE-2026-4819 In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana. Medium Tue, 31 Mar 2026 14:57:56 GMT https://vulnogram.org/CVE-2026-4818 https://vulnogram.org/CVE-2026-4818 In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams. Medium Tue, 31 Mar 2026 14:53:19 GMT https://vulnogram.org/CVE-2026-4799 https://vulnogram.org/CVE-2026-4799 In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL. Medium Network Exploitable Tue, 31 Mar 2026 14:41:05 GMT https://vulnogram.org/CVE-2025-13653 https://vulnogram.org/CVE-2025-13653 In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective pri… Medium Mon, 01 Dec 2025 18:02:00 GMT https://vulnogram.org/CVE-2025-12149 https://vulnogram.org/CVE-2025-12149 In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indi… Medium Fri, 14 Nov 2025 13:58:42 GMT https://vulnogram.org/CVE-2025-12148 https://vulnogram.org/CVE-2025-12148 In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fields is properly redacted in the _source document returned by search operations, the results… Medium Wed, 29 Oct 2025 15:31:32 GMT https://vulnogram.org/CVE-2025-12147 https://vulnogram.org/CVE-2025-12147 In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is cor… Medium Wed, 29 Oct 2025 15:29:54 GMT https://vulnogram.org/CVE-2019-13422 https://vulnogram.org/CVE-2019-13422 Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login. Fri, 23 Aug 2019 13:35:03 GMT https://vulnogram.org/CVE-2019-13423 https://vulnogram.org/CVE-2019-13423 Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana… Fri, 23 Aug 2019 13:30:26 GMT https://vulnogram.org/CVE-2019-13421 https://vulnogram.org/CVE-2019-13421 Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database. Fri, 23 Aug 2019 13:26:46 GMT https://vulnogram.org/CVE-2019-13415 https://vulnogram.org/CVE-2019-13415 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see. Tue, 13 Aug 2019 18:59:59 GMT https://vulnogram.org/CVE-2019-13416 https://vulnogram.org/CVE-2019-13416 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s). Tue, 13 Aug 2019 18:58:45 GMT https://vulnogram.org/CVE-2019-13419 https://vulnogram.org/CVE-2019-13419 Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. Tue, 13 Aug 2019 14:28:44 GMT https://vulnogram.org/CVE-2019-13420 https://vulnogram.org/CVE-2019-13420 Search Guard versions before 21.0 had an timing side channel issue when using the internal user database. Tue, 13 Aug 2019 14:25:43 GMT https://vulnogram.org/CVE-2019-13418 https://vulnogram.org/CVE-2019-13418 Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. Mon, 12 Aug 2019 21:12:11 GMT https://vulnogram.org/CVE-2019-13417 https://vulnogram.org/CVE-2019-13417 Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated. Mon, 12 Aug 2019 20:51:23 GMT