# cve.now: Elastic

The newest entries naming Elastic as an affected vendor (up to 200), of 396 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115714](https://cve.now/CVE-2026-115714.md): Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections (CVSS 7.4)
- [CVE-2026-115716](https://cve.now/CVE-2026-115716.md): Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-115715](https://cve.now/CVE-2026-115715.md): Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-115710](https://cve.now/CVE-2026-115710.md): Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure (CVSS 4.2)
- [CVE-2026-115298](https://cve.now/CVE-2026-115298.md): Incorrect Authorization in Elasticsearch Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-115297](https://cve.now/CVE-2026-115297.md): NULL Pointer Dereference in Packetbeat Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-115295](https://cve.now/CVE-2026-115295.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-115294](https://cve.now/CVE-2026-115294.md): Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion (CVSS 7.3)
- [CVE-2026-115293](https://cve.now/CVE-2026-115293.md): Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure (CVSS 6.5)
- [CVE-2026-115292](https://cve.now/CVE-2026-115292.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-115290](https://cve.now/CVE-2026-115290.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 7.5)
- [CVE-2026-115289](https://cve.now/CVE-2026-115289.md): Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-115713](https://cve.now/CVE-2026-115713.md): Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and… (CVSS 7.5)
- [CVE-2026-115712](https://cve.now/CVE-2026-115712.md): Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings (CVSS 4.3)
- [CVE-2026-115711](https://cve.now/CVE-2026-115711.md): Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential… (CVSS 6.4)
- [CVE-2026-115709](https://cve.now/CVE-2026-115709.md): Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and… (CVSS 8.2)
- [CVE-2026-115708](https://cve.now/CVE-2026-115708.md): Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass (CVSS 7.2)
- [CVE-2026-115707](https://cve.now/CVE-2026-115707.md): Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege… (CVSS 6.4)
- [CVE-2026-115706](https://cve.now/CVE-2026-115706.md): Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation (CVSS 6.8)
- [CVE-2026-103009](https://cve.now/CVE-2026-103009.md): Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure (CVSS 7.1)
- [CVE-2026-103008](https://cve.now/CVE-2026-103008.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-103007](https://cve.now/CVE-2026-103007.md): Incorrect Authorization in Elasticsearch Leading to Privilege Escalation (CVSS 7.2)
- [CVE-2026-103006](https://cve.now/CVE-2026-103006.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-103005](https://cve.now/CVE-2026-103005.md): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-102413](https://cve.now/CVE-2026-102413.md): Uncaught Exception in Elastic Endpoint Leading to Denial of Service (CVSS 6.2)
- [CVE-2026-102412](https://cve.now/CVE-2026-102412.md): Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure (CVSS 6.5)
- [CVE-2026-102411](https://cve.now/CVE-2026-102411.md): Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-102410](https://cve.now/CVE-2026-102410.md): Missing Authorization in Kibana Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-102409](https://cve.now/CVE-2026-102409.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-102408](https://cve.now/CVE-2026-102408.md): Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service (CVSS 4.3)
- [CVE-2026-102407](https://cve.now/CVE-2026-102407.md): Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification (CVSS 5.4)
- [CVE-2026-102406](https://cve.now/CVE-2026-102406.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception (CVSS 8.8)
- [CVE-2026-102404](https://cve.now/CVE-2026-102404.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-94408](https://cve.now/CVE-2026-94408.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 4.9)
- [CVE-2026-94397](https://cve.now/CVE-2026-94397.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5)
- [CVE-2026-94396](https://cve.now/CVE-2026-94396.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5)
- [CVE-2026-94400](https://cve.now/CVE-2026-94400.md): Uncontrolled Resource Consumption in Kibana Leading to denial of service (CVSS 6.5)
- [CVE-2026-94399](https://cve.now/CVE-2026-94399.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5)
- [CVE-2026-94398](https://cve.now/CVE-2026-94398.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5)
- [CVE-2026-82300](https://cve.now/CVE-2026-82300.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-82294](https://cve.now/CVE-2026-82294.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-78582](https://cve.now/CVE-2026-78582.md): Missing Authorization in Kibana Leading to Unauthorized Deletion of Data (CVSS 6.5)
- [CVE-2026-72662](https://cve.now/CVE-2026-72662.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data (CVSS 6.3)
- [CVE-2026-72668](https://cve.now/CVE-2026-72668.md): Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation (CVSS 7.3)
- [CVE-2026-82302](https://cve.now/CVE-2026-82302.md): Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification (CVSS 8.1)
- [CVE-2026-82299](https://cve.now/CVE-2026-82299.md): Incorrect Authorization in Kibana Leading to Information Disclosure (CVSS 6.5)
- [CVE-2026-82298](https://cve.now/CVE-2026-82298.md): Incorrect Authorization in Kibana Leading to Denial of Service (CVSS 4.3)
- [CVE-2026-78596](https://cve.now/CVE-2026-78596.md): Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations (CVSS 4.3)
- [CVE-2026-78595](https://cve.now/CVE-2026-78595.md): Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure (CVSS 4.3)
- [CVE-2026-78593](https://cve.now/CVE-2026-78593.md): Improper Control of Generation of Code in Kibana Leading to Privilege Escalation (CVSS 4.3)
- [CVE-2026-78583](https://cve.now/CVE-2026-78583.md): Incorrect Authorization in Kibana Leading to Privilege Escalation (CVSS 8.1)
- [CVE-2026-82293](https://cve.now/CVE-2026-82293.md): Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption (CVSS 4.3)
- [CVE-2026-78588](https://cve.now/CVE-2026-78588.md): Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-78587](https://cve.now/CVE-2026-78587.md): Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations (CVSS 3.1)
- [CVE-2026-78586](https://cve.now/CVE-2026-78586.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-78584](https://cve.now/CVE-2026-78584.md): Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure (CVSS 4.3)
- [CVE-2026-78591](https://cve.now/CVE-2026-78591.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion (CVSS 6.3)
- [CVE-2026-78590](https://cve.now/CVE-2026-78590.md): Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources (CVSS 7.3)
- [CVE-2026-78599](https://cve.now/CVE-2026-78599.md): Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources (CVSS 6.5)
- [CVE-2026-78598](https://cve.now/CVE-2026-78598.md): Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data (CVSS 5.4)
- [CVE-2026-78594](https://cve.now/CVE-2026-78594.md): Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service (CVSS 4.9)
- [CVE-2026-78604](https://cve.now/CVE-2026-78604.md): Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM (CVSS 7.8)
- [CVE-2026-78602](https://cve.now/CVE-2026-78602.md): Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure (CVSS 5.3)
- [CVE-2026-78601](https://cve.now/CVE-2026-78601.md): Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure (CVSS 5.5)
- [CVE-2026-78600](https://cve.now/CVE-2026-78600.md): Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention (CVSS 3.5)
- [CVE-2026-78609](https://cve.now/CVE-2026-78609.md): Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data (CVSS 5.4)
- [CVE-2026-63138](https://cve.now/CVE-2026-63138.md): Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure (CVSS 6.5)
- [CVE-2026-78597](https://cve.now/CVE-2026-78597.md): Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation (CVSS 4.3)
- [CVE-2026-78592](https://cve.now/CVE-2026-78592.md): Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources (CVSS 7.3)
- [CVE-2026-78606](https://cve.now/CVE-2026-78606.md): Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data (CVSS 4.2)
- [CVE-2026-78603](https://cve.now/CVE-2026-78603.md): Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata (CVSS 4.3)
- [CVE-2026-78607](https://cve.now/CVE-2026-78607.md): Missing Authorization in Elasticsearch Leading to Information Disclosure (CVSS 5.4)
- [CVE-2026-78608](https://cve.now/CVE-2026-78608.md): Missing Authorization in Kibana Leading to Information Disclosure (CVSS 6.5)
- [CVE-2026-78605](https://cve.now/CVE-2026-78605.md): Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure (CVSS 5.9)
- [CVE-2026-72654](https://cve.now/CVE-2026-72654.md): Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure (CVSS 6.5)
- [CVE-2026-72633](https://cve.now/CVE-2026-72633.md): Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring (CVSS 4.3)
- [CVE-2026-72641](https://cve.now/CVE-2026-72641.md): Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data (CVSS 5.4)
- [CVE-2026-72628](https://cve.now/CVE-2026-72628.md): Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72644](https://cve.now/CVE-2026-72644.md): Uncaught Exception in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72649](https://cve.now/CVE-2026-72649.md): Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution (CVSS 8.8)
- [CVE-2026-72682](https://cve.now/CVE-2026-72682.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-63137](https://cve.now/CVE-2026-63137.md): Incorrect Authorization in Kibana Leading to Privilege Escalation (CVSS 8.3)
- [CVE-2026-72652](https://cve.now/CVE-2026-72652.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-56143](https://cve.now/CVE-2026-56143.md): Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 4.9)
- [CVE-2026-33465](https://cve.now/CVE-2026-33465.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2024-14047](https://cve.now/CVE-2024-14047.md): Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service (CVSS 7.2)
- [CVE-2026-78581](https://cve.now/CVE-2026-78581.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana (CVSS 4.2)
- [CVE-2026-49096](https://cve.now/CVE-2026-49096.md): Uncaught Exception in Kibana Cases Leading to Denial of Service (CVSS 4.3)
- [CVE-2026-72636](https://cve.now/CVE-2026-72636.md): Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72632](https://cve.now/CVE-2026-72632.md): Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys (CVSS 7.1)
- [CVE-2026-72631](https://cve.now/CVE-2026-72631.md): Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys (CVSS 6.5)
- [CVE-2026-72630](https://cve.now/CVE-2026-72630.md): Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation (CVSS 7.1)
- [CVE-2026-72629](https://cve.now/CVE-2026-72629.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models (CVSS 7.1)
- [CVE-2026-72643](https://cve.now/CVE-2026-72643.md): Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents (CVSS 7.1)
- [CVE-2026-72642](https://cve.now/CVE-2026-72642.md): Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process (CVSS 8.8)
- [CVE-2026-72640](https://cve.now/CVE-2026-72640.md): Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure (CVSS 6.5)
- [CVE-2026-72639](https://cve.now/CVE-2026-72639.md): Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72638](https://cve.now/CVE-2026-72638.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72647](https://cve.now/CVE-2026-72647.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72645](https://cve.now/CVE-2026-72645.md): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72648](https://cve.now/CVE-2026-72648.md): Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure (CVSS 6.5)
- [CVE-2026-72657](https://cve.now/CVE-2026-72657.md): Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure (CVSS 6.5)
- [CVE-2026-72656](https://cve.now/CVE-2026-72656.md): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72655](https://cve.now/CVE-2026-72655.md): Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification (CVSS 4.3)
- [CVE-2026-72653](https://cve.now/CVE-2026-72653.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72651](https://cve.now/CVE-2026-72651.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72650](https://cve.now/CVE-2026-72650.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-72663](https://cve.now/CVE-2026-72663.md): Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72661](https://cve.now/CVE-2026-72661.md): Missing Authorization in Kibana Leading to Information Disclosure (CVSS 6.5)
- [CVE-2026-72660](https://cve.now/CVE-2026-72660.md): Uncaught Exception in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72659](https://cve.now/CVE-2026-72659.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72658](https://cve.now/CVE-2026-72658.md): Cross-Site Request Forgery in Kibana Leading to Privilege Escalation (CVSS 7.3)
- [CVE-2026-72667](https://cve.now/CVE-2026-72667.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72666](https://cve.now/CVE-2026-72666.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts (CVSS 6.8)
- [CVE-2026-72665](https://cve.now/CVE-2026-72665.md): Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions (CVSS 8.1)
- [CVE-2026-72664](https://cve.now/CVE-2026-72664.md): Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions (CVSS 6.5)
- [CVE-2026-72677](https://cve.now/CVE-2026-72677.md): Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources (CVSS 7.3)
- [CVE-2026-72676](https://cve.now/CVE-2026-72676.md): Improper Control of Generation of Code in Fleet Server Leading to Code Injection (CVSS 6.5)
- [CVE-2026-72675](https://cve.now/CVE-2026-72675.md): Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification (CVSS 7.1)
- [CVE-2026-72674](https://cve.now/CVE-2026-72674.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72673](https://cve.now/CVE-2026-72673.md): Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations (CVSS 5.4)
- [CVE-2026-72672](https://cve.now/CVE-2026-72672.md): Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data (CVSS 7.7)
- [CVE-2026-72671](https://cve.now/CVE-2026-72671.md): Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments (CVSS 4.3)
- [CVE-2026-72670](https://cve.now/CVE-2026-72670.md): Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials (CVSS 7.7)
- [CVE-2026-72669](https://cve.now/CVE-2026-72669.md): Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering (CVSS 7.6)
- [CVE-2026-72681](https://cve.now/CVE-2026-72681.md): Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure (CVSS 6.5)
- [CVE-2026-72680](https://cve.now/CVE-2026-72680.md): Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification (CVSS 6.5)
- [CVE-2026-72679](https://cve.now/CVE-2026-72679.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72678](https://cve.now/CVE-2026-72678.md): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72687](https://cve.now/CVE-2026-72687.md): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72686](https://cve.now/CVE-2026-72686.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72685](https://cve.now/CVE-2026-72685.md): Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service (CVSS 4.3)
- [CVE-2026-72684](https://cve.now/CVE-2026-72684.md): Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-72683](https://cve.now/CVE-2026-72683.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-49089](https://cve.now/CVE-2026-49089.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-63263](https://cve.now/CVE-2026-63263.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-63262](https://cve.now/CVE-2026-63262.md): Missing Authorization in Kibana Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-63261](https://cve.now/CVE-2026-63261.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-63260](https://cve.now/CVE-2026-63260.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-63259](https://cve.now/CVE-2026-63259.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-63145](https://cve.now/CVE-2026-63145.md): Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise (CVSS 4.3)
- [CVE-2026-63144](https://cve.now/CVE-2026-63144.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-63143](https://cve.now/CVE-2026-63143.md): Missing Authorization in Kibana Leading to Unauthorized Information Disclosure (CVSS 4.3)
- [CVE-2026-63142](https://cve.now/CVE-2026-63142.md): Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery (CVSS 5.0)
- [CVE-2026-63141](https://cve.now/CVE-2026-63141.md): Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions (CVSS 6.3)
- [CVE-2026-63140](https://cve.now/CVE-2026-63140.md): Reachable Assertion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-63139](https://cve.now/CVE-2026-63139.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-63136](https://cve.now/CVE-2026-63136.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-56147](https://cve.now/CVE-2026-56147.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise (CVSS 7.1)
- [CVE-2026-56146](https://cve.now/CVE-2026-56146.md): Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure (CVSS 5.4)
- [CVE-2026-56145](https://cve.now/CVE-2026-56145.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-56144](https://cve.now/CVE-2026-56144.md): Incorrect Authorization in Elasticsearch Leading to Information Disclosure (CVSS 5.3)
- [CVE-2026-42397](https://cve.now/CVE-2026-42397.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-49092](https://cve.now/CVE-2026-49092.md): Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure (CVSS 4.3)
- [CVE-2026-49091](https://cve.now/CVE-2026-49091.md): Improper Output Neutralization for Logs in Kibana Leading to Log Injection (CVSS 8.0)
- [CVE-2026-49090](https://cve.now/CVE-2026-49090.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-49088](https://cve.now/CVE-2026-49088.md): Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure (CVSS 4.4)
- [CVE-2026-49087](https://cve.now/CVE-2026-49087.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-56152](https://cve.now/CVE-2026-56152.md): Incorrect Authorization in Kibana Leading to Information Disclosure (CVSS 5.3)
- [CVE-2026-56151](https://cve.now/CVE-2026-56151.md): Improper Input Validation in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-56150](https://cve.now/CVE-2026-56150.md): Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-56149](https://cve.now/CVE-2026-56149.md): Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 4.9)
- [CVE-2026-56148](https://cve.now/CVE-2026-56148.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-49093](https://cve.now/CVE-2026-49093.md): Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access (CVSS 6.3)
- [CVE-2026-49094](https://cve.now/CVE-2026-49094.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-49095](https://cve.now/CVE-2026-49095.md): Improper Input Validation in Kibana Fleet Leading to Privilege Escalation (CVSS 7.2)
- [CVE-2026-42398](https://cve.now/CVE-2026-42398.md): Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access (CVSS 7.7)
- [CVE-2026-42399](https://cve.now/CVE-2026-42399.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-42400](https://cve.now/CVE-2026-42400.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-42401](https://cve.now/CVE-2026-42401.md): Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection (CVSS 4.1)
- [CVE-2026-33463](https://cve.now/CVE-2026-33463.md): Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access (CVSS 5.3)
- [CVE-2026-33464](https://cve.now/CVE-2026-33464.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-33462](https://cve.now/CVE-2026-33462.md): Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts (CVSS 4.6)
- [CVE-2026-33467](https://cve.now/CVE-2026-33467.md): Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass (CVSS 5.9)
- [CVE-2026-33466](https://cve.now/CVE-2026-33466.md): Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write (CVSS 8.1)
- [CVE-2026-33458](https://cve.now/CVE-2026-33458.md): Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure (CVSS 6.8)
- [CVE-2026-33459](https://cve.now/CVE-2026-33459.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-33460](https://cve.now/CVE-2026-33460.md): Incorrect Authorization in Kibana Fleet Leading to Information Disclosure (CVSS 4.3)
- [CVE-2026-33461](https://cve.now/CVE-2026-33461.md): Incorrect Authorization in Kibana Fleet Leading to Information Disclosure (CVSS 7.7)
- [CVE-2026-4498](https://cve.now/CVE-2026-4498.md): Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope (CVSS 7.7)
- [CVE-2026-26940](https://cve.now/CVE-2026-26940.md): Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-26939](https://cve.now/CVE-2026-26939.md): Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration (CVSS 6.5)
- [CVE-2026-26933](https://cve.now/CVE-2026-26933.md): Improper Validation of Array Index in Packetbeat Leading to Denial of Service (CVSS 5.7)
- [CVE-2026-26931](https://cve.now/CVE-2026-26931.md): Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service (CVSS 5.7)
- [CVE-2026-26938](https://cve.now/CVE-2026-26938.md): Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF) (CVSS 8.6)
- [CVE-2026-26937](https://cve.now/CVE-2026-26937.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-26936](https://cve.now/CVE-2026-26936.md): Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service (CVSS 4.9)
- [CVE-2026-26935](https://cve.now/CVE-2026-26935.md): Improper Input Validation in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-26934](https://cve.now/CVE-2026-26934.md): Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service (CVSS 6.5)
- [CVE-2026-26932](https://cve.now/CVE-2026-26932.md): Improper Validation of Array Index in Packetbeat Leading to Denial of Service (CVSS 5.7)
- [CVE-2026-0532](https://cve.now/CVE-2026-0532.md): External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector (CVSS 8.6)
- [CVE-2026-0529](https://cve.now/CVE-2026-0529.md): Improper Validation of Array Index in Packetbeat Leading to Overflow Buffers (CVSS 6.5)
- [CVE-2026-0543](https://cve.now/CVE-2026-0543.md): Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation (CVSS 6.5)
- [CVE-2026-0531](https://cve.now/CVE-2026-0531.md): Allocation of Resources Without Limits or Throttling in Kibana Fleet (CVSS 6.5)
- [CVE-2026-0530](https://cve.now/CVE-2026-0530.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation (CVSS 6.5)
- [CVE-2026-0528](https://cve.now/CVE-2026-0528.md): Improper Input Validation in Metricbeat Leading to Denial of Service (CVSS 6.5)
- [CVE-2025-68422](https://cve.now/CVE-2025-68422.md): Kibana Improper Authorization (CVSS 4.3)
- [CVE-2025-68386](https://cve.now/CVE-2025-68386.md): Kibana Improper Authorization (CVSS 4.3)
- [CVE-2025-68390](https://cve.now/CVE-2025-68390.md): Elasticsearch Allocation of Resources Without Limits or Throttling (CVSS 4.9)
- [CVE-2025-68389](https://cve.now/CVE-2025-68389.md): Kibana Allocation of Resources Without Limits or Throttling (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/elastic
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.