EL
Vendor
Elasticsearch
16
CVEs
0
On KEV
0
New 30D
Products
PA7.5
Packetbeat
Elasticsearch
6 CVEs0 on KEV0 new
KI6.7
Kibana
Elasticsearch
3 CVEs0 on KEV0 new
LO7.8
Logstash
Elasticsearch
3 CVEs0 on KEV0 new
CE5.9
Cloud Enterprise
Elasticsearch
1 CVEs0 on KEV0 new
OP6.5
Output Plugin
Elasticsearch
1 CVEs0 on KEV0 new
XP5.3
X-pack
Elasticsearch
1 CVEs0 on KEV0 new
XR5.3
X-pack Reporting
Elasticsearch
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-26933 | PA Packetbeat Elasticsearch | 5.7 | Mar 19 | Improper Validation of Array Index in Packetbeat Leading to Denial of Service |
| CVE-2026-26932 | PA Packetbeat Elasticsearch | 7.5 | Feb 26 | Improper Validation of Array Index in Packetbeat Leading to Denial of Service |
| CVE-2025-68382 | PA Packetbeat Elasticsearch | 6.5 | Dec 18 | Packetbeat Out-of-bounds Read |
| CVE-2025-68381 | PA Packetbeat Elasticsearch | 6.5 | Dec 18 | Packetbeat Improper Bounds Check |
| CVE-2025-68388 | PA Packetbeat Elasticsearch | 5.3 | Dec 18 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the… |
| CVE-2020-7017 | KI Kibana Elasticsearch | 6.7 | Jul 27 | In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw |
| CVE-2020-7016 | KI Kibana Elasticsearch | 4.8 | Jul 27 | Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion |
| CVE-2017-11480 | PA Packetbeat Elasticsearch | 7.5 | Dec 8 | Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler |
| CVE-2017-8444 | CE Cloud Enterprise Elasticsearch | 5.9 | Sep 29 | The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper |
| CVE-2017-11479 | KI Kibana Elasticsearch | 6.1 | Sep 29 | Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive… |
| CVE-2017-14730 | LO Logstash Elasticsearch | 7.8 | Sep 25 | The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users… |
| CVE-2017-8446 | XP X-pack Elasticsearch | 5.3 | Aug 18 | The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability |
| CVE-2015-5619 | LO Logstash Elasticsearch | 5.9 | Aug 9 | Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might… |
| CVE-2015-5378 | LO Logstash Elasticsearch | 7.5 | Jun 27 | Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server |
| CVE-2016-10362 | OP Output Plugin Elasticsearch | 6.5 | Jun 16 | Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials |