Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

Medium6.5Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, proc…CVE-2026-26939 · elastic · kibana · CVE.org · NIST NVD · ElasticsearchMar 19, 2026
Medium5.7Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153).CVE-2026-26933 · elasticsearch · packetbeat · CVE.org · NIST NVD · ElasticsearchMar 19, 2026
Medium4.6ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary H…CVE-2026-1527 · nodejs · undici · CVE.org · NIST NVD · Elasticsearch, Node.jsMar 12, 2026
High7.7Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files fr…CVE-2026-26938 · elastic · kibana · CVE.org · NIST NVD · ElasticsearchFeb 26, 2026
High7.5Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)CVE-2026-26937 · elastic · kibana · CVE.org · NIST NVD · ElasticsearchFeb 26, 2026
High7.5Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential B…CVE-2026-26936 · elastic · kibana · CVE.org · NIST NVD · ElasticsearchFeb 26, 2026
High7.5Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)CVE-2026-26935 · elastic · kibana · CVE.org · NIST NVD · ElasticsearchFeb 26, 2026
Medium6.5Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via…CVE-2026-26934 · elastic · kibana · CVE.org · NIST NVD · ElasticsearchFeb 26, 2026
High7.5Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153).CVE-2026-26932 · elasticsearch · packetbeat · CVE.org · NIST NVD · Elasticsearch, PostgreSQLFeb 26, 2026
Critical10.0Kibana Arbitrary Code ExecutionCVE-2019-7609 · elastic · kibana · CISA KEV · CVE.org · FIRST EPSS · ElasticsearchKEVEPSS 95.3%Mar 25, 2019
Critical9.8Elasticsearch Groovy Scripting Engine Remote Code Execution VulnerabilityCVE-2015-1427 · n/a · n/a · CISA KEV · CVE.org · FIRST EPSS · ElasticsearchKEVEPSS 99.9%Feb 17, 2015
High8.1Elasticsearch Remote Code Execution VulnerabilityCVE-2014-3120 · n/a · n/a · CISA KEV · CVE.org · FIRST EPSS · ElasticsearchKEVEPSS 88.6%Jul 28, 2014