KI
Product
Kibana
On CISA KEVExploited in the wild
201
CVEs
1
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 8High 44Medium 144Low 3
Watch
Add Kibana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-7609 In wildKEV | 10.0 | Mar 25 | Kibana Arbitrary Code Execution Affected: before 5.6.15 and 6.6.1 |
| CVE-2025-25015 | 9.9 | Mar 5 | Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests Affected: 8.15.0 before 8.16.6; 8.17.0 before 8.17.3 |
| CVE-2025-25014 | 9.8 | May 6 | A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints Affected: 8.3.0 before 8.17.6; 8.18.0; 9.0.0 |
| CVE-2024-12556 | 9.8 | Apr 8 | Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal Affected: 8.16.1 before 8.16.4; 8.17.0 before 8.17.2 |
| CVE-2018-17246 | 9.8 | Dec 20 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin Affected: 5.0.0 before 5.6.13; 6.0.0 before 6.4.3 |
| CVE-2018-17245 | 9.8 | Dec 20 | Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports Affected: 4.0.0 through 4.6.0; 5.0.0 through 5.6.12; 6.0.0 through 6.4.2 |
| CVE-2026-72676 | 9.1 | Aug 13 | Improper Control of Generation of Code in Fleet Server Leading to Code Injection Affected: 8.5.0 before 8.19.20; 9.0.0 before 9.4.5; 9.5.0 |
| CVE-2019-7610 | 9.0 | Mar 25 | Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger Affected: before 5.6.15; 6.0.0 before 6.6.1 |
Showing 8