KI
Product
Kibana
On CISA KEVExploited in the wild
201
CVEs
1
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 8High 44Medium 144Low 3
Watch
Add Kibana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-72675 | 7.1 | Aug 13 | Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-56147 | 7.1 | Jul 21 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise Affected: 9.0.0 through 9.3.6; 9.4.0 through 9.4.2; 8.7.0 through 8.19.17 |
| CVE-2026-72666 | 6.8 | Aug 13 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Affected: 9.1.0 through 9.4.4 |
| CVE-2026-102412 | 6.5 | Oct 6 | Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Affected: 9.3.0 through 9.3.8; 9.4.0 through 9.4.7; 9.5.0 through 9.5.4 |
| CVE-2026-94400 | 6.5 | Sep 26 | Uncontrolled Resource Consumption in Kibana Leading to denial of service Affected: 8.0.0 through 8.19.21; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2 |
| CVE-2026-78582 | 6.5 | Sep 26 | Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Affected: 7.12.0 through 7.17.29; 8.0.0 through 8.19.21; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2 |
| CVE-2026-82299 | 6.5 | Sep 3 | Incorrect Authorization in Kibana Leading to Information Disclosure Affected: 9.0.0 through 9.4.5; 9.5.0 through 9.5.2 |
| CVE-2026-78586 | 6.5 | Sep 2 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.15; 9.0.0 through 9.3.4; 9.4.0 through 9.4.1 |
| CVE-2026-78599 | 6.5 | Sep 2 | Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources Affected: 8.0.0 through 8.19.17; 9.0.0 through 9.4.2 |
| CVE-2026-63138 | 6.5 | Sep 1 | Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure Affected: 9.4.0 through 9.4.4; 9.5.0 |
| CVE-2026-78608 | 6.5 | Sep 1 | Missing Authorization in Kibana Leading to Information Disclosure Affected: 7.14.0 through 7.17.29; 8.0.0 through 8.19.20; 9.0.0 through 9.4.5; 9.5.0 through 9.5.1 |
| CVE-2026-72654 | 6.5 | Sep 1 | Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Affected: 8.0.0 through 8.19.20; 9.0.0 through 9.4.5; 9.5.0 through 9.5.1 |
| CVE-2026-72628 | 6.5 | Sep 1 | Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service Affected: 8.19.0 through 8.19.20; 9.0.0 through 9.4.5; 9.5.0 through 9.5.1 |
| CVE-2026-72644 | 6.5 | Sep 1 | Uncaught Exception in Kibana Leading to Denial of Service Affected: 9.1.7 through 9.4.4; 9.5.0 |
| CVE-2026-72682 | 6.5 | Sep 1 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 9.3.0 through 9.4.5 |
| CVE-2026-72652 | 6.5 | Sep 1 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.18; 9.0.0 through 9.3.4 |
| CVE-2026-33465 | 6.5 | Sep 1 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.16; 9.0.0 through 9.2.8 |
| CVE-2026-72631 | 6.5 | Aug 13 | Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Affected: 9.1.0 through 9.4.4; 9.5.0 |
| CVE-2026-72653 | 6.5 | Aug 13 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 8.12.0 through 8.19.18; 9.0.0 through 9.3.7; 9.4.0 through 9.4.3 |
| CVE-2026-72651 | 6.5 | Aug 13 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72663 | 6.5 | Aug 13 | Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72661 | 6.5 | Aug 13 | Missing Authorization in Kibana Leading to Information Disclosure Affected: 8.12.0 through 8.19.18; 9.0.0 through 9.3.7; 9.4.0 through 9.4.3 |
| CVE-2026-72660 | 6.5 | Aug 13 | Uncaught Exception in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.3.7; 9.4.0 through 9.4.4 |
| CVE-2026-72659 | 6.5 | Aug 13 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72667 | 6.5 | Aug 13 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72664 | 6.5 | Aug 13 | Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Affected: 8.9.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72674 | 6.5 | Aug 13 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 9.3.0 through 9.3.7; 9.4.0 through 9.4.3 |
| CVE-2026-72670 | 6.5 | Aug 13 | Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-49089 | 6.5 | Aug 13 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-63261 | 6.5 | Jul 21 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.18; 9.4.0 through 9.4.3; 9.0.0 through 9.3.7 |
| CVE-2026-63260 | 6.5 | Jul 21 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Affected: 9.0.0 through 9.3.7; 8.0.0 through 8.19.18; 9.4.0 through 9.4.3 |
| CVE-2026-63139 | 6.5 | Jul 21 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.18; 9.4.0 through 9.4.3; 9.3.0 through 9.3.7 |
| CVE-2026-42397 | 6.5 | Jul 21 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 9.4.0 through 9.4.3; 9.3.0 through 9.3.6 |
| CVE-2026-49087 | 6.5 | Jul 1 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Affected: 9.0.0 through 9.3.3; 8.0.0 through 8.19.14 |
| CVE-2026-56151 | 6.5 | Jul 1 | Improper Input Validation in Kibana Leading to Denial of Service Affected: 9.0.0 through 9.3.5; 8.0.0 through 8.19.16; 9.4.0 through 9.4.2 |
| CVE-2026-49094 | 6.5 | May 28 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.15 |
| CVE-2026-49095 | 6.5 | May 28 | Improper Input Validation in Kibana Fleet Leading to Privilege Escalation Affected: 9.0.0 through 9.3.4; 9.4.0 through 9.4.1; 8.0.0 through 8.19.15 |
| CVE-2026-42399 | 6.5 | May 28 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Affected: 8.0.0 through 8.19.15; 9.0.0 through 9.3.4 |
| CVE-2026-42400 | 6.5 | May 28 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Affected: 9.4.0 through 9.4.1; 9.0.0 through 9.3.4; 8.0.0 through 8.19.15 |
| CVE-2026-33464 | 6.5 | May 28 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Affected: 9.4.0 through 9.4.0; 9.0.0 through 9.3.4; 8.0.0 through 8.19.15 |
| CVE-2026-33459 | 6.5 | Apr 8 | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Affected: 9.3.0 through 9.3.2; 8.15.0 through 8.19.13; 9.0.0 through 9.2.7 |
| CVE-2026-33461 | 6.5 | Apr 8 | Incorrect Authorization in Kibana Fleet Leading to Information Disclosure Affected: 9.3.0 through 9.3.2; 9.0.0 through 9.2.7; 8.0.0 through 8.19.13 |
| CVE-2026-26940 | 6.5 | Mar 19 | Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service Affected: 9.3.0 through 9.3.1; 9.0.0 through 9.2.6; 8.0.0 through 8.19.12 |
| CVE-2026-26939 | 6.5 | Mar 19 | Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration Affected: 9.0.0 through 9.2.5; 9.3.0 through 9.3.0; 8.0.0 through 8.19.11 |
| CVE-2026-26934 | 6.5 | Feb 26 | Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service Affected: 8.18.0 through 8.19.11; 9.0.0 through 9.2.5; 9.3.0 through 9.3.0 |
| CVE-2026-0543 | 6.5 | Jan 13 | Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation Affected: 8.0.0 through 8.19.9; 7.0.0 through 7.17.29; 9.0.0 through 9.1.9; 9.2.0 through 9.2.3 |
| CVE-2026-0531 | 6.5 | Jan 13 | Allocation of Resources Without Limits or Throttling in Kibana Fleet Affected: 7.10.0 through 7.17.29; 8.0.0 through 8.19.9; 9.0.0 through 9.1.9; 9.2.0 through 9.2.3 |
| CVE-2026-0530 | 6.5 | Jan 13 | Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation Affected: 7.10.0 through 7.17.29; 8.0.0 through 8.19.9; 9.0.0 through 9.1.9; 9.2.0 through 9.2.3 |
| CVE-2025-68389 | 6.5 | Dec 18 | Kibana Allocation of Resources Without Limits or Throttling Affected: 7.0.0 through 7.17.29; 8.0.0 through 8.19.8; 9.0.0 through 9.1.8; 9.2.0 through 9.2.2 |
| CVE-2025-25010 | 6.5 | Aug 28 | Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.3 |