Known Vulnerabilities for products from Elastic
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Elastic".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-28261 json | Not Provided | 2026-04-08 | 2026-04-08 | |
| CVE-2025-28985 json | Not Provided | 2025-06-06 | 2026-04-01 | |
| CVE-2023-46673 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7.5 - HIGH | 2023-11-22 | 2023-11-30 |
| CVE-2023-46672 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 5.5 - MEDIUM | 2023-11-15 | 2024-01-25 |
| CVE-2023-46668 json | If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set... | 9.1 - CRITICAL | 2023-10-26 | 2023-11-06 |
| CVE-2023-46667 json | An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fle... | 8.1 - HIGH | 2023-10-26 | 2023-11-03 |
| CVE-2023-46666 json | An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint O... | 6.5 - MEDIUM | 2023-10-26 | 2023-11-07 |
| CVE-2023-31422 json | An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The iss... | 7.5 - HIGH | 2023-10-26 | 2023-11-03 |
| CVE-2023-31421 json | It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether ... | 7.5 - HIGH | 2023-10-26 | 2023-11-08 |
| CVE-2023-31419 json | A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a St... | 7.5 - HIGH | 2023-10-26 | 2024-02-01 |
| CVE-2023-31418 json | An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user coul... | 7.5 - HIGH | 2023-10-26 | 2023-11-30 |
| CVE-2023-31417 json | Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that ... | 4.4 - MEDIUM | 2023-10-26 | 2024-01-03 |
| CVE-2023-31416 json | Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests ... | 5.3 - MEDIUM | 2023-10-26 | 2023-11-06 |
| CVE-2023-31415 json | Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feat... | 8.8 - HIGH | 2023-05-04 | 2023-05-11 |
| CVE-2023-31414 json | Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or... | 8.8 - HIGH | 2023-05-04 | 2023-05-11 |
| CVE-2023-31413 json | Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-... | 3.3 - LOW | 2023-05-04 | 2023-05-11 |
| CVE-2022-38779 json | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they us... | 6.1 - MEDIUM | 2023-02-22 | 2023-03-03 |
| CVE-2022-38778 json | A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user ... | 6.5 - MEDIUM | 2023-02-08 | 2023-02-16 |
| CVE-2022-38777 json | An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged user... | 7.8 - HIGH | 2023-02-08 | 2023-02-21 |
| CVE-2022-38775 json | An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged user... | 7.8 - HIGH | 2023-01-26 | 2023-02-03 |
Known software with vulnerabilities from Elastic
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Elastic | Apm-agent-ruby | - |
| Application | Elastic | Apm Agent | - |
| Application | Elastic | Elasticsearch | 0.10.0 |
| Application | Elastic | Elasticsearch X-pack | 5.0.0 |
| Application | Elastic | Elastic App Search | 7.7.0 |
| Application | Elastic | Elastic Cloud Enterprise | 1.0.0 |
| Application | Elastic | Elastic Cloud On Kubernetes | 1.1.0 |
| Application | Elastic | Enterprise Search | - |
| Application | Elastic | Kibana | 0.10.0 |
| Application | Elastic | Kibana Reporting | 2.4.0 |
| Application | Elastic | Kibana X-pack | 5.0.0 |
| Application | Elastic | Logstash | 1.0.0 |
| Application | Elastic | Logstash X-pack | 5.6.0 |
| Application | Elastic | Winlogbeat | 1.1.0 |
| Application | Elastic | X-pack | 5.0.0 |