Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-26940Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
- CVE-2026-26939Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration
- CVE-2026-26933Improper Validation of Array Index in Packetbeat Leading to Denial of Service
- CVE-2026-26931Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service
- CVE-2026-26938Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)
- CVE-2026-26937Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-26936Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service
- CVE-2026-26935Improper Input Validation in Kibana Leading to Denial of Service
- CVE-2026-26934Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
- CVE-2026-26932Improper Validation of Array Index in Packetbeat Leading to Denial of Service
- CVE-2026-0532External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector
- CVE-2026-0529Improper Validation of Array Index in Packetbeat Leading to Overflow Buffers
- CVE-2026-0543Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation
- CVE-2026-0531Allocation of Resources Without Limits or Throttling in Kibana Fleet
- CVE-2026-0530Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation
- CVE-2026-0528Improper Input Validation in Metricbeat Leading to Denial of Service
- CVE-2025-68422Kibana Improper Authorization
- CVE-2025-68386Kibana Improper Authorization
- CVE-2025-68390Elasticsearch Allocation of Resources Without Limits or Throttling
- CVE-2025-68389Kibana Allocation of Resources Without Limits or Throttling
- CVE-2025-68387Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2025-68385Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2025-68384Elasticsearch Allocation of Resources Without Limits or Throttling
- CVE-2025-68383Filebeat Improper Validation of Specified Index, Position, or Offset in Input
- CVE-2025-68382Packetbeat Out-of-bounds Read
- CVE-2025-68381Packetbeat Improper Bounds Check
- CVE-2025-68388Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPE
- CVE-2025-37731Elasticsearch Improper Authentication
- CVE-2025-37732Kibana Cross-site Scripting via the Integration Package Upload Functionality
- CVE-2025-37734Kibana Origin Validation Error