Known Vulnerabilities for products from Elastic
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Elastic".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-49095 json | Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An a... | Not Provided | 2026-05-28 | 2026-06-01 |
| CVE-2026-49094 json | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An ... | Not Provided | 2026-05-28 | 2026-06-01 |
| CVE-2026-49093 json | Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypas... | Not Provided | 2026-05-28 | 2026-06-01 |
| CVE-2026-42401 json | Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with... | Not Provided | 2026-05-28 | 2026-05-29 |
| CVE-2026-42400 json | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An ... | Not Provided | 2026-05-28 | 2026-06-01 |
| CVE-2026-42399 json | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An ... | Not Provided | 2026-05-28 | 2026-06-01 |
| CVE-2026-42398 json | Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the... | Not Provided | 2026-05-28 | 2026-06-01 |
| CVE-2026-33467 json | Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to ... | Not Provided | 2026-04-28 | 2026-05-05 |
| CVE-2026-33466 json | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potenti... | Not Provided | 2026-04-08 | 2026-04-21 |
| CVE-2026-33464 json | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A... | Not Provided | 2026-05-28 | 2026-05-29 |
| CVE-2026-33463 json | Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. ... | Not Provided | 2026-05-28 | 2026-05-29 |
| CVE-2026-33462 json | A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limi... | Not Provided | 2026-05-28 | 2026-05-29 |
| CVE-2026-33461 json | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with l... | Not Provided | 2026-04-08 | 2026-04-22 |
| CVE-2026-33460 json | Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A... | Not Provided | 2026-04-08 | 2026-04-21 |
| CVE-2026-33459 json | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An ... | Not Provided | 2026-04-08 | 2026-04-13 |
| CVE-2026-33458 json | Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with w... | Not Provided | 2026-04-08 | 2026-04-13 |
| CVE-2026-28261 json | Not Provided | 2026-04-08 | 2026-04-09 | |
| CVE-2026-4498 json | Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data b... | Not Provided | 2026-04-08 | 2026-04-13 |
| CVE-2025-66525 json | Not Provided | 2025-12-09 | 2026-04-27 | |
| CVE-2025-28985 json | Not Provided | 2025-06-06 | 2026-04-23 |
Known software with vulnerabilities from Elastic
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Elastic | Apm-agent-ruby | - |
| Application | Elastic | Apm Agent | - |
| Application | Elastic | Elasticsearch | 0.10.0 |
| Application | Elastic | Elasticsearch X-pack | 5.0.0 |
| Application | Elastic | Elastic App Search | 7.7.0 |
| Application | Elastic | Elastic Cloud Enterprise | 1.0.0 |
| Application | Elastic | Elastic Cloud On Kubernetes | 1.1.0 |
| Application | Elastic | Enterprise Search | - |
| Application | Elastic | Kibana | 0.10.0 |
| Application | Elastic | Kibana Reporting | 2.4.0 |
| Application | Elastic | Kibana X-pack | 5.0.0 |
| Application | Elastic | Logstash | 1.0.0 |
| Application | Elastic | Logstash X-pack | 5.6.0 |
| Application | Elastic | Winlogbeat | 1.1.0 |
| Application | Elastic | X-pack | 5.0.0 |