Known Vulnerabilities for products from Elastic
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Elastic".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-33466 json | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potenti... | Not Provided | 2026-04-08 | 2026-04-21 |
| CVE-2026-33461 json | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with l... | Not Provided | 2026-04-08 | 2026-04-22 |
| CVE-2026-33460 json | Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A... | Not Provided | 2026-04-08 | 2026-04-21 |
| CVE-2026-33459 json | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An ... | Not Provided | 2026-04-08 | 2026-04-13 |
| CVE-2026-33458 json | Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with w... | Not Provided | 2026-04-08 | 2026-04-13 |
| CVE-2026-28261 json | Not Provided | 2026-04-08 | 2026-04-09 | |
| CVE-2026-4498 json | Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data b... | Not Provided | 2026-04-08 | 2026-04-13 |
| CVE-2025-28985 json | Not Provided | 2025-06-06 | 2026-04-01 | |
| CVE-2023-46673 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7.5 - HIGH | 2023-11-22 | 2023-11-30 |
| CVE-2023-46672 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 5.5 - MEDIUM | 2023-11-15 | 2024-01-25 |
| CVE-2023-46668 json | If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set... | 9.1 - CRITICAL | 2023-10-26 | 2023-11-06 |
| CVE-2023-46667 json | An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fle... | 8.1 - HIGH | 2023-10-26 | 2023-11-03 |
| CVE-2023-46666 json | An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint O... | 6.5 - MEDIUM | 2023-10-26 | 2023-11-07 |
| CVE-2023-31422 json | An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The iss... | 7.5 - HIGH | 2023-10-26 | 2023-11-03 |
| CVE-2023-31421 json | It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether ... | 7.5 - HIGH | 2023-10-26 | 2023-11-08 |
| CVE-2023-31419 json | A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a St... | 7.5 - HIGH | 2023-10-26 | 2024-02-01 |
| CVE-2023-31418 json | An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user coul... | 7.5 - HIGH | 2023-10-26 | 2023-11-30 |
| CVE-2023-31417 json | Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that ... | 4.4 - MEDIUM | 2023-10-26 | 2024-01-03 |
| CVE-2023-31416 json | Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests ... | 5.3 - MEDIUM | 2023-10-26 | 2023-11-06 |
| CVE-2023-31415 json | Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feat... | 8.8 - HIGH | 2023-05-04 | 2023-05-11 |
Known software with vulnerabilities from Elastic
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Elastic | Apm-agent-ruby | - |
| Application | Elastic | Apm Agent | - |
| Application | Elastic | Elasticsearch | 0.10.0 |
| Application | Elastic | Elasticsearch X-pack | 5.0.0 |
| Application | Elastic | Elastic App Search | 7.7.0 |
| Application | Elastic | Elastic Cloud Enterprise | 1.0.0 |
| Application | Elastic | Elastic Cloud On Kubernetes | 1.1.0 |
| Application | Elastic | Enterprise Search | - |
| Application | Elastic | Kibana | 0.10.0 |
| Application | Elastic | Kibana Reporting | 2.4.0 |
| Application | Elastic | Kibana X-pack | 5.0.0 |
| Application | Elastic | Logstash | 1.0.0 |
| Application | Elastic | Logstash X-pack | 5.6.0 |
| Application | Elastic | Winlogbeat | 1.1.0 |
| Application | Elastic | X-pack | 5.0.0 |