CveMateVulnerability intelligence

Elastic vulnerabilities, page 4

396 vulnerabilities

Known vulnerabilities in Elastic products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 59 products.

CVE-2016-10364elasticelastic x-pack security+19y ago16-06-2017 21:00

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions.CVE-2016-10363elasticlogstash9y ago16-06-2017 21:00

Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of service attack on the Logstash instance. The errors resulting from these crafted inputs are not handled by the codec and can cause the Logstash process to exit.CVE-2016-10365elastickibana9y ago16-06-2017 21:00

Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to an arbitrary website.CVE-2016-10362elasticlogstash+29y ago16-06-2017 21:00

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.CVE-2025-68389chainguardkibana-8.17-bitnami+310mo ago18-12-2025 22:14

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.CVE-2025-68384chainguardcommercial-elasticsearch-8.17+2810mo ago18-12-2025 22:04

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.CVE-2025-68383chainguardagentbeat+14210mo ago18-12-2025 22:00

Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.CVE-2025-68385chainguardkibana-8.17-bitnami+310mo ago18-12-2025 22:08

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.CVE-2025-68388chainguardagentbeat+13110mo ago18-12-2025 21:33

Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat.CVE-2025-68422chainguardkibana-8.17-bitnami+310mo ago18-12-2025 22:32

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.CVE-2025-68390chainguardcommercial-elasticsearch-8.17+3210mo ago18-12-2025 22:17

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.CVE-2025-68382elasticpacketbeat+110mo ago18-12-2025 21:56

Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service (DoS) through a reliable process crash when handling truncated XDR-encoded RPC messages.CVE-2025-68386chainguardkibana-8.17-bitnami+310mo ago18-12-2025 22:21

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.CVE-2025-68381elasticpacketbeat+110mo ago18-12-2025 21:51

Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number.CVE-2025-68387chainguardkibana-8.17-bitnami+310mo ago18-12-2025 22:11

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.CVE-2025-0712elasticapm_server1y ago30-07-2025 00:12

An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.CVE-2025-25011elasticbeats1y ago30-07-2025 00:15

An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.CVE-2025-25018chainguardkibana-8.17-bitnami+31y ago10-10-2025 09:50

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)CVE-2025-25012chainguardkibana-8.17-bitnami+31y ago25-06-2025 11:52

URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.CVE-2025-25013elasticelastic defend1y ago08-04-2025 22:16

Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack.