Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-37736Elastic Cloud Enterprise Improper Authorization
- CVE-2025-37735Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defen
- CVE-2025-37729Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine
- CVE-2025-37727Elasticsearch Insertion of sensitive information in log file
- CVE-2025-25017Kibana Stored Cross-Site Scripting (XSS)
- CVE-2025-25018Kibana Stored Cross-Site Scripting (XSS)
- CVE-2025-25009Kibana Cross-Site Scripting (XSS)
- CVE-2025-37728Kibana Insufficiently Protected Credentials in the CrowdStrike Connector
- CVE-2025-25010Kibana privilege escalation via reporting_user role
- CVE-2025-25011Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer
- CVE-2025-0712APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer
- CVE-2025-25012Kibana Open Redirect
- CVE-2024-43706Kibana Improper Authorization
- CVE-2025-25014Kibana arbitrary code execution via prototype pollution
- CVE-2025-37730Logstash Improper Certificate Validation in TCP output
- CVE-2024-52979Elasticsearch Uncontrolled Resource Consumption vulnerability
- CVE-2024-11390Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
- CVE-2025-25016Kibana Unrestricted Upload of File
- CVE-2024-11994APM Server Insertion of Sensitive Information into Log File
- CVE-2024-52976Elastic Agent Inclusion of Functionality from Untrusted Control Sphere
- CVE-2023-46669Elastic Agent / Elastic Endpoint Security local API key disclosure
- CVE-2025-25013Elastic Defend Insertion of Sensitive Information into Log Files
- CVE-2024-12556Kibana Prototype Pollution can lead to code injection
- CVE-2024-52981An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection o
- CVE-2024-52974An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash.
- CVE-2024-52980Elasticsearch Uncontrolled Resource Consumption vulnerability
- CVE-2025-25015Kibana arbitrary code execution via prototype pollution
- CVE-2024-43708An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of i
- CVE-2024-52975Fleet Server sensitive information exposure via logs
- CVE-2024-52972Kibana allocation of resources without limits or throttling leads to crash