Elastic Kibana
192 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-102412 | 9.3.0 – 9.3.8 ; 9.4.0 – 9.4.7 ; 9.5.0 – 9.5.4 | Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-102410 | 9.2.0 – 9.3.8 | Missing Authorization in Kibana Leading to Information Disclosure | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-102406 | 8.14.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.3 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception | HIGH 8.8 | 0.3 % | ||
| CVE-2026-94400 | 8.0.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.2 | Uncontrolled Resource Consumption in Kibana Leading to denial of service | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-78582 | 7.12.0 – 7.17.29 ; 8.0.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; … | Missing Authorization in Kibana Leading to Unauthorized Deletion of Data | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-72662 | 8.0.0 – 8.19.21 ; 9.4.0 – 9.4.5 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-72668 | 9.4.0 – 9.4.6 | Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation | HIGH 7.3 | 0.2 % | ||
| CVE-2026-82302 | 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.2 | Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification | HIGH 8.1 | 0.4 % | ||
| CVE-2026-82299 | 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.2 | Incorrect Authorization in Kibana Leading to Information Disclosure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-82298 | 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.2 | Incorrect Authorization in Kibana Leading to Denial of Service | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-78596 | 8.18.3 – 8.19.20 ; 9.0.3 – 9.4.5 ; 9.5.0 – 9.5.2 | Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-78595 | 9.1.0 – 9.4.5 ; 9.5.0 – 9.5.2 | Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-78593 | 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.2 | Improper Control of Generation of Code in Kibana Leading to Privilege Escalation | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-78583 | 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.2 | Incorrect Authorization in Kibana Leading to Privilege Escalation | HIGH 8.1 | 0.4 % | ||
| CVE-2026-82293 | 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.1 | Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-78586 | 8.0.0 – 8.19.15 ; 9.0.0 – 9.3.4 ; 9.4.0 – 9.4.1 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-78584 | 9.4.0 – 9.4.3 | Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-78591 | 8.0.0 – 8.19.16 ; 9.0.0 – 9.3.5 ; 9.4.0 – 9.4.2 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-78590 | 8.0.0 – 8.19.17 ; 9.0.0 – 9.3.5 ; 9.4.0 – 9.4.2 | Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources | HIGH 7.3 | 0.4 % | ||
| CVE-2026-78599 | 8.0.0 – 8.19.17 ; 9.0.0 – 9.4.2 | Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-78598 | 8.0.0 – 8.19.18 ; 9.0.0 – 9.3.7 ; 9.4.0 – 9.4.3 | Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-78601 | 9.4.0 – 9.4.4 | Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure | MEDIUM 5.5 | 0.3 % | ||
| CVE-2026-63138 | 9.4.0 – 9.4.4 ; 9.5.0 | Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-78597 | 8.0.0 – 8.19.20 ; 9.0.3 – 9.4.5 | Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-78592 | 7.11.0 – 7.17.29 ; 8.0.0 – 8.19.15 ; 9.0.0 – 9.3.4 ; … | Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources | HIGH 7.3 | 0.4 % | ||
| CVE-2026-78606 | 8.19.11 – 8.19.20 ; 9.3.0 – 9.4.5 ; 9.5.0 – 9.5.1 | Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-78603 | 9.0.0 – 9.4.5 ; 9.5.0 | Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-78608 | 7.14.0 – 7.17.29 ; 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; … | Missing Authorization in Kibana Leading to Information Disclosure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72654 | 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.1 | Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-72633 | 9.1.0 – 9.4.5 ; 9.5.0 – 9.5.1 | Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-72641 | 9.4.0 – 9.4.5 ; 9.5.0 | Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-72628 | 8.19.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.1 | Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-72644 | 9.1.7 – 9.4.4 ; 9.5.0 | Uncaught Exception in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72682 | 9.3.0 – 9.4.5 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-63137 | 9.3.0 – 9.4.2 | Incorrect Authorization in Kibana Leading to Privilege Escalation | HIGH 8.3 | 0.5 % | ||
| CVE-2026-72652 | 8.0.0 – 8.19.18 ; 9.0.0 – 9.3.4 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-33465 | 8.0.0 – 8.19.16 ; 9.0.0 – 9.2.8 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-78581 | 8.0.0 – 8.16.2 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-49096 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.3.4 ; 9.4.0 ; … | Uncaught Exception in Kibana Cases Leading to Denial of Service | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-72632 | 8.19.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys | HIGH 7.1 | 0.3 % | ||
| CVE-2026-72631 | 9.1.0 – 9.4.4 ; 9.5.0 | Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-72630 | 8.19.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation | HIGH 7.1 | 0.3 % | ||
| CVE-2026-72629 | 8.19.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models | HIGH 7.1 | 0.4 % | ||
| CVE-2026-72643 | 9.4.0 – 9.4.4 ; 9.5.0 | Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents | HIGH 7.1 | 0.4 % | ||
| CVE-2026-72655 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-72653 | 8.12.0 – 8.19.18 ; 9.0.0 – 9.3.7 ; 9.4.0 – 9.4.3 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72651 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72650 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-72663 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-72661 | 8.12.0 – 8.19.18 ; 9.0.0 – 9.3.7 ; 9.4.0 – 9.4.3 | Missing Authorization in Kibana Leading to Information Disclosure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72660 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.3.7 ; 9.4.0 – 9.4.4 | Uncaught Exception in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-72659 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72658 | 8.19.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Cross-Site Request Forgery in Kibana Leading to Privilege Escalation | HIGH 7.3 | 0.2 % | ||
| CVE-2026-72667 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72666 | 9.1.0 – 9.4.4 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts | MEDIUM 6.8 | 0.4 % | ||
| CVE-2026-72665 | 8.5.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions | HIGH 8.1 | 0.5 % | ||
| CVE-2026-72664 | 8.9.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72677 | 8.0.0 – 8.19.16 ; 9.0.0 – 9.3.5 ; 9.4.0 – 9.4.2 | Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources | HIGH 7.3 | 0.4 % | ||
| CVE-2026-72675 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification | HIGH 7.1 | 0.3 % | ||
| CVE-2026-72674 | 9.3.0 – 9.3.7 ; 9.4.0 – 9.4.3 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72673 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.3 | Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-72672 | 9.1.0 – 9.4.4 | Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data | HIGH 7.7 | 0.4 % | ||
| CVE-2026-72671 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-72670 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials | HIGH 7.7 | 0.5 % | ||
| CVE-2026-72669 | 8.9.0 – 8.19.18 ; 9.0.0 – 9.4.4 | Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering | HIGH 7.6 | 0.3 % | ||
| CVE-2026-72681 | 9.4.0 – 9.4.3 | Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure | HIGH 8.8 | 0.4 % | ||
| CVE-2026-72680 | 9.2.0 – 9.4.4 | Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-49089 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-63262 | 9.4.0 – 9.4.3 | Missing Authorization in Kibana Leading to Information Disclosure | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-63261 | 8.0.0 – 8.19.18 ; 9.4.0 – 9.4.3 ; 9.0.0 – 9.3.7 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-63260 | 9.0.0 – 9.3.7 ; 8.0.0 – 8.19.18 ; 9.4.0 – 9.4.3 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-63259 | 9.4.0 – 9.4.3 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-63145 | 9.4.0 – 9.4.3 ; 9.0.0 – 9.3.7 ; 8.0.0 – 8.19.18 | Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-63143 | 9.4.0 – 9.4.3 ; 9.3.0 – 9.3.7 | Missing Authorization in Kibana Leading to Unauthorized Information Disclosure | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-63142 | 9.4.0 – 9.4.3 ; 8.0.0 – 8.19.18 ; 9.0.0 – 9.3.7 | Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-63141 | 9.4.0 – 9.4.3 ; 9.3.0 – 9.3.7 | Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-63139 | 8.0.0 – 8.19.18 ; 9.4.0 – 9.4.3 ; 9.3.0 – 9.3.7 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-56147 | 9.0.0 – 9.3.6 ; 9.4.0 – 9.4.2 ; 8.7.0 – 8.19.17 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity C… | HIGH 7.1 | 0.3 % | ||
| CVE-2026-56146 | 9.4.0 – 9.4.2 | Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-42397 | 9.4.0 – 9.4.3 ; 9.3.0 – 9.3.6 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-49092 | 9.4.0 – 9.4.2 | Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-49091 | 8.0.0 – 8.11.0 ; 7.0.0 – 7.17.14 | Improper Output Neutralization for Logs in Kibana Leading to Log Injection | HIGH 8.0 | 0.3 % | ||
| CVE-2026-49088 | 8.0.0 – 8.18.8 ; 9.1.0 – 9.1.5 ; 9.0.0 – 9.0.7 ; … | Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure | MEDIUM 4.4 | 0.3 % | ||
| CVE-2026-49087 | 9.0.0 – 9.3.3 ; 8.0.0 – 8.19.14 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-56152 | 9.3.0 – 9.3.1 ; 8.6.0 – 8.19.12 ; 9.0.0 – 9.2.6 | Incorrect Authorization in Kibana Leading to Information Disclosure | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-56151 | 9.0.0 – 9.3.5 ; 8.0.0 – 8.19.16 ; 9.4.0 – 9.4.2 | Improper Input Validation in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-49093 | 9.3.0 – 9.3.2 | Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access | HIGH 7.7 | 0.2 % | ||
| CVE-2026-49094 | 8.0.0 – 8.19.15 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-49095 | 9.0.0 – 9.3.4 ; 9.4.0 – 9.4.1 ; 8.0.0 – 8.19.15 | Improper Input Validation in Kibana Fleet Leading to Privilege Escalation | HIGH 7.2 | 0.3 % | ||
| CVE-2026-42398 | 9.3.0 – 9.3.1 ; 9.0.0 – 9.2.7 | Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access | HIGH 7.7 | 0.3 % | ||
| CVE-2026-42399 | 8.0.0 – 8.19.15 ; 9.0.0 – 9.3.4 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-42400 | 9.4.0 – 9.4.1 ; 9.0.0 – 9.3.4 ; 8.0.0 – 8.19.15 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-42401 | 9.0.0 – 9.3.4 ; 8.0.0 – 8.19.15 | Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-33463 | 8.0.0 – 8.19.15 ; 9.0.0 – 9.3.4 | Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-33464 | 9.4.0 ; 9.0.0 – 9.3.4 ; 8.0.0 – 8.19.15 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-33462 | 9.0.0 – 9.3.4 ; 8.0.0 – 8.19.15 | Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts | HIGH 7.3 | 0.2 % | ||
| CVE-2026-33458 | 9.3.0 – 9.3.2 | Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure | HIGH 7.7 | 0.2 % | ||
| CVE-2026-33459 | 9.3.0 – 9.3.2 ; 8.15.0 – 8.19.13 ; 9.0.0 – 9.2.7 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-33460 | 9.3.0 – 9.3.2 ; 9.0.0 – 9.2.7 ; 8.0.0 – 8.19.13 | Incorrect Authorization in Kibana Fleet Leading to Information Disclosure | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-33461 | 9.3.0 – 9.3.2 ; 9.0.0 – 9.2.7 ; 8.0.0 – 8.19.13 | Incorrect Authorization in Kibana Fleet Leading to Information Disclosure | HIGH 7.7 | 0.3 % | ||
| CVE-2026-4498 | 8.0.0 – 8.19.13 | Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope | HIGH 7.7 | 0.3 % | ||
| CVE-2026-26940 | 9.3.0 – 9.3.1 ; 9.0.0 – 9.2.6 ; 8.0.0 – 8.19.12 | Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-26939 | 9.0.0 – 9.2.5 ; 9.3.0 ; 8.0.0 – 8.19.11 | Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-26938 | 9.3.0 | Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF) | HIGH 8.6 | 0.3 % | ||
| CVE-2026-26937 | 9.0.0 – 9.2.4 ; 8.0.0 – 8.19.10 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service | HIGH 7.5 | 0.3 % | ||
| CVE-2026-26936 | 9.0.0 – 9.2.4 ; 8.0.0 – 8.19.10 | Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service | HIGH 7.5 | 0.4 % | ||
| CVE-2026-26935 | 9.3.0 ; 8.4.0 – 8.19.11 ; 9.0.0 – 9.2.5 | Improper Input Validation in Kibana Leading to Denial of Service | HIGH 7.5 | 0.3 % | ||
| CVE-2026-26934 | 8.18.0 – 8.19.11 ; 9.0.0 – 9.2.5 ; 9.3.0 | Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-0532 | 8.15.0 – 8.19.9 ; 9.0.0 – 9.1.9 ; 9.2.0 – 9.2.3 | External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector | HIGH 8.6 | 0.5 % | ||
| CVE-2026-0543 | 8.0.0 – 8.19.9 ; 7.0.0 – 7.17.29 ; 9.0.0 – 9.1.9 ; … | Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-0531 | 7.10.0 – 7.17.29 ; 8.0.0 – 8.19.9 ; 9.0.0 – 9.1.9 ; … | Allocation of Resources Without Limits or Throttling in Kibana Fleet | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-0530 | 7.10.0 – 7.17.29 ; 8.0.0 – 8.19.9 ; 9.0.0 – 9.1.9 ; … | Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-68422 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.6 ; 9.0.0 – 9.1.6 ; … | Kibana Improper Authorization | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-68386 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.7 ; 9.0.0 – 9.1.7 ; … | Kibana Improper Authorization | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-68389 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.8 ; 9.0.0 – 9.1.8 ; … | Kibana Allocation of Resources Without Limits or Throttling | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-68387 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.8 ; 9.0.0 – 9.1.8 ; … | Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-68385 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.8 ; 9.0.0 – 9.1.8 ; … | Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | HIGH 7.2 | 0.3 % | ||
| CVE-2025-37732 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.7 ; 9.0.0 – 9.1.7 ; … | Kibana Cross-site Scripting via the Integration Package Upload Functionality | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-37734 | 8.12.0 – 8.19.6 ; 9.1.0 – 9.1.6 ; 9.2.0 | Kibana Origin Validation Error | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-37735 | 8.0.0 – 8.19.5 ; 9.0.0 – 9.1.5 | Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defen | HIGH 7.0 | 0.1 % | ||
| CVE-2025-25017 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.18.7 ; 8.19.0 – 8.19.3 ; … | Kibana Stored Cross-Site Scripting (XSS) | HIGH 8.2 | 0.3 % | ||
| CVE-2025-25018 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.18.7 ; 8.19.0 – 8.19.4 ; … | Kibana Stored Cross-Site Scripting (XSS) | HIGH 8.7 | 0.2 % | ||
| CVE-2025-25009 | 7.0.0 – 7.17.29 ; 8.14.0 – 8.18.7 ; 8.19.0 – 8.19.4 ; … | Kibana Cross-Site Scripting (XSS) | HIGH 8.7 | 0.2 % | ||
| CVE-2025-37728 | 7.0.0 – 7.17.29 ; 8.14.0 – 8.18.7 ; 8.19.0 – 8.19.4 ; … | Kibana Insufficiently Protected Credentials in the CrowdStrike Connector | MEDIUM 5.4 | 0.3 % | ||
| CVE-2025-25010 | 9.0.0 – 9.0.5 ; 9.1.0 – 9.1.2 | Kibana privilege escalation via reporting_user role | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-25012 | 7.0.0 – 7.17.28 ; 8.0.0 – 8.17.7 ; 8.18.0 – 8.18.2 ; … | Kibana Open Redirect | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-43706 | 8.12.0 – < 8.12.1 | Kibana Improper Authorization | HIGH 8.8 | 0.4 % | ||
| CVE-2025-25014 | 8.3.0 – < 8.17.6 ; 8.18.0 – < 8.18.1 ; 9.0.0 – < 9.0.1 | Kibana arbitrary code execution via prototype pollution | CRITICAL 9.8 | 22 % | ||
| CVE-2024-11390 | 7.17.6 – < 7.17.23 ; 8.4.0 – < 8.11.4 | Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS | MEDIUM 5.4 | 0.4 % | ||
| CVE-2025-25016 | 7.17.0 – < 7.17.18 ; 8.0.0 – < 8.13.0 | Kibana Unrestricted Upload of File | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-12556 | 8.16.1 – < 8.17.1 | Kibana Prototype Pollution can lead to code injection | CRITICAL 9.8 | 0.6 % | ||
| CVE-2024-52974 | 7.17.0 – 7.17.22 ; 8.0.0 – 8.15.0 | An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A succe | MEDIUM 6.5 | 0.4 % | ||
| CVE-2025-25015 | 8.15.0 – < 8.16.6 ; 8.17.0 – < 8.17.3 | Kibana arbitrary code execution via prototype pollution | CRITICAL 9.9 | 1.3 % | ||
| CVE-2024-43708 | 8.0.0 – < 8.15.0 ; 7.0.0 – < 7.17.23 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of i | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-52972 | 8.0.0 – < 8.15.0 ; 7.0.0 – < 7.17.23 | Kibana allocation of resources without limits or throttling leads to crash | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-43707 | 8.0.0 – < 8.15.0 | Kibana exposure of sensitive information to an unauthorized actor | HIGH 7.7 | 0.4 % | ||
| CVE-2024-43710 | 8.7.0 – < 8.15.0 | Kibana server-side request forgery | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-52973 | 7.17.0, 8.0.0 – < 7.17.23, 8.14.2 | Kibana allocation of resources without limits or throttling leads to crash | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-37285 | 8.10.0 – 8.15.0 | Kibana arbitrary code execution via YAML deserialization | CRITICAL 9.1 | 1.2 % | ||
| CVE-2024-37288 | 8.15.0 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted pa | CRITICAL 9.9 | 1.0 % | ||
| CVE-2024-37287 | 7.7.0, 8.0.0 – < 7.17.23, 8.14.2 | Kibana arbitrary code execution via prototype pollution | CRITICAL 9.1 | 1.6 % | ||
| CVE-2024-37281 | 7.x – < 7.17.23 ; 8.x – < 8.14.0 | Kibana Denial of Service issue | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-23443 | < 8.14.0 ; < 7.17.22 | A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted | MEDIUM 4.9 | 1.8 % | ||
| CVE-2024-23442 | 8.11.1 – 8.13.4 ; 7.17.21 | Kibana open redirect issue | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-37279 | 8.6.3 – 8.13.4 | Kibana Broken Access Control issue | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-23446 | 8.12.0 – < 8.12.1 | Kibana Broken Access Control issue | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-46675 | 7.13.0 – < 7.17.16 ; 8.0.0 – < 8.11.2 | Kibana Insertion of Sensitive Information into Log File | HIGH 8.0 | 0.7 % | ||
| CVE-2023-46671 | 8.0.0 – < 8.11.1 | Kibana Insertion of Sensitive Information into Log File | HIGH 8.0 | 0.7 % | ||
| CVE-2021-22142 | 7.0.0 – < 7.13.0 | Kibana Reporting vulnerabilities | HIGH 8.8 | 1.0 % | ||
| CVE-2021-22151 | 7.9.0 – < 7.14.0 | Kibana path traversal issue | MEDIUM 4.3 | 0.7 % | ||
| CVE-2021-22150 | 7.10.2 – < 7.14.0 | Kibana code execution issue | HIGH 7.2 | 1.2 % | ||
| CVE-2023-31422 | 8.10.0 | Kibana Insertion of Sensitive Information into Log File | CRITICAL 9.0 | 0.8 % | ||
| CVE-2023-31415 | version 8.7.0 | Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send | CRITICAL 9.9 | 1.0 % | ||
| CVE-2023-31414 | versions 8.0.0 through 8.7.0 | Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configurat | HIGH 8.8 | 0.6 % | ||
| CVE-2022-38779 | Kibana Versions 7.0.0 through 7.17.8 and 8.0.0 through 8.6.1 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously | MEDIUM 6.1 | 0.5 % | ||
| CVE-2022-38778 | Versions 7.0.0 through 7.17.8 and 8.0.0 through 8.6.0 | A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a requ | MEDIUM 6.5 | 0.9 % | ||
| CVE-2021-37936 | versions before 7.14.1 | It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ab | MEDIUM 5.4 | 0.5 % | ||
| CVE-2021-22141 | All versions of Kibana before 7.13.0 and 6.8.16. | An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-23713 | Versions 7.0.0 through 7.17.4 and 8.0.0 through 8.2.3 | A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be | MEDIUM 6.1 | 0.8 % | ||
| CVE-2022-23711 | Versions 7.2.1 through 7.17.2 & 8.0.0 through 8.1.2 | A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack mo | MEDIUM 5.3 | 0.9 % | ||
| CVE-2022-23710 | For self-managed deployments the issue impacts versions 7.15.0, 7.15.1, and 7.15.2
For Elastic Cloud Services the issue impacts versions 7.15.0 through 7.17.0, and 8.0.0 | A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which co | MEDIUM 6.1 | 0.8 % | ||
| CVE-2022-23709 | Versions 7.7.0 through 7.17.0, and 8.0.0 | A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privileg | MEDIUM 4.3 | 0.6 % | ||
| CVE-2022-23707 | 7.5.1 through 7.16.3 | An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index pa | MEDIUM 5.4 | 0.5 % | ||
| CVE-2021-37939 | All versions from 7.8.0 through 7.15.1 | It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which | LOW 2.7 | 0.5 % | ||
| CVE-2021-37938 | All versions from 7.9.0 through 7.15.1 | It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf file | MEDIUM 4.3 | 0.7 % | ||
| CVE-2021-22139 | before 7.12.1 | Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-22136 | before 7.12.0 and 6.8.15 | In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout settin | LOW 3.5 | 0.3 % | ||
| CVE-2020-7017 | before 6.8.11 and 7.8.1 | In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or cr | MEDIUM 6.7 | 1.2 % | ||
| CVE-2020-7016 | before 6.8.11 and 7.8.1 | Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed | MEDIUM 4.8 | 1.1 % | ||
| CVE-2020-7015 | before 6.8.9 and 7.7.0 | Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSV | MEDIUM 5.4 | 0.8 % | ||
| CVE-2020-7013 | before 6.8.9 and 7.7.0 | Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB | HIGH 7.2 | 2.1 % | ||
| CVE-2020-7012 | 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 | Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker wit | HIGH 8.8 | 18 % | ||
| CVE-2019-7621 | before 6.8.6 and 7.5.1 | Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacke | MEDIUM 5.4 | 0.7 % | ||
| CVE-2019-7616 | before 7.2.1 and 6.8.2 | Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer | MEDIUM 4.9 | 2.4 % | ||
| CVE-2019-7610 | before 6.6.1 | Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpa | CRITICAL 9.0 | 3.9 % | ||
| CVE-2019-7608 | before 5.6.15 and 6.6.1 | Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive info | MEDIUM 6.1 | 1.3 % | ||
| CVE-2019-7609 | before 5.6.15 and 6.6.1 | Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the | CRITICAL 10.0 | 95 % | KEV | |
| CVE-2018-17246 | before 6.4.3 and 5.6.13 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kiban | CRITICAL 9.8 | 84 % | ||
| CVE-2018-17245 | 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 | Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating P | CRITICAL 9.8 | 1.5 % | ||
| CVE-2018-3830 | after 5.3.0, before 5.6.12 and 6.4.1 | Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to | MEDIUM 6.1 | 1.6 % | ||
| CVE-2018-3821 | after 5.1.1 and before 5.6.7 and 6.1.3 | Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that co | MEDIUM 6.1 | 0.9 % | ||
| CVE-2018-3820 | after 6.1.0 and before 6.1.3 | Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attac | MEDIUM 6.1 | 0.8 % | ||
| CVE-2018-3819 | All versions before 6.1.3 and 5.6.7 | The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect | MEDIUM 6.1 | 0.8 % | ||
| CVE-2018-3818 | 5.1.1 to 6.1.2 and 5.6.6 | Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an | MEDIUM 6.1 | 1.0 % | ||
| CVE-2017-11482 | before 6.0.1 and 5.6.5 | The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redi | MEDIUM 6.1 | 0.7 % | ||
| CVE-2017-11481 | before 6.0.1 and 5.6.5 | Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtai | MEDIUM 6.1 | 0.8 % | ||
| CVE-2017-8452 | before 5.2.1 | Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will | HIGH 7.5 | 1.4 % | ||
| CVE-2016-10366 | 4.3 to 4.6.2 | Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack. | MEDIUM 6.1 | 0.9 % | ||
| CVE-2016-10365 | before 5.0.1 and 4.6.3 | Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domai | MEDIUM 6.1 | 1.0 % | ||
| CVE-2015-9056 | before 4.1.3 and 4.2.1 | Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack. | MEDIUM 6.1 | 0.8 % | ||
| CVE-2017-8440 | 5.3.0 to 5.3.3 ; 5.4.1 | Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain | MEDIUM 6.1 | 1.0 % | ||
| CVE-2017-8439 | 5.4.0 | Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to | MEDIUM 6.1 | 1.0 % |