Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownCVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory toolOct 14, 2026
- MediumIncorrect Authorization in Kibana Leading to Sensitive Information DisclosureOct 14, 2026
- MediumMissing Authorization in Kibana Leading to Information DisclosureOct 14, 2026
- HighAuthorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data InterceptionOct 14, 2026
- UnknownCGA-xv9f-vqcx-9xjwOct 13, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).EPSS 0.5%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).EPSS 0.5%May 28, 2026
- High7.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist.EPSS 0.4%May 28, 2026
- Medium5.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection.EPSS 0.1%May 28, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130).EPSS 0.5%May 28, 2026
- Medium5.3Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure.EPSS 0.4%May 28, 2026
- High7.3A path traversal vulnerability was identified in Kibana's dashboard management functionality.EPSS 0.2%May 28, 2026
- Medium5.3phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoi…May 15, 2026
- Critical9.1The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface.May 12, 2026
- Medium6.5The Elasticsearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — i…May 11, 2026
- Medium6.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.Apr 27, 2026
- Medium6.1Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string.Apr 24, 2026
- Medium6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).Apr 8, 2026
- High7.7Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure.Apr 8, 2026
- High7.7Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope…Apr 8, 2026
- Medium6.5Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122).Apr 8, 2026
- Medium4.3Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122).Apr 8, 2026
- Low2.0A vulnerability was determined in Dataease SQLbot up to 1.6.0.Apr 2, 2026
- Medium6.5In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.Mar 31, 2026
- Medium6.5Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130).Mar 19, 2026
37 records · page 1 of 2
PreviousNext