CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 2 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 00%
Medium: 179100%
Low or not scored: 00%

Matching CVEs: 179; Last two years
Critical: 0; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 0; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 41 · September 2026

Most CVEs

In each company's software, last two years

Matching CVEs

6.1Med
CVE-2025-68385 (opens in a new tab)
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.
Elastic Cloud· Dec 18, 2025
5.3Med
CVE-2025-68388 (opens in a new tab)
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat.
Elastic Cloud· Dec 18, 2025
6.5Med
CVE-2025-68384 (opens in a new tab)
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
Elastic Cloud· Dec 18, 2025
6.5Med
CVE-2025-68383 (opens in a new tab)
Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.
Elastic Cloud· Dec 18, 2025
6.5Med
CVE-2025-68382 (opens in a new tab)
Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service (DoS) through a reliable process crash when handling truncated XDR-encoded RPC messages.
Elastic Cloud· Dec 18, 2025
6.5Med
CVE-2025-68381 (opens in a new tab)
Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number.
Elastic Cloud· Dec 18, 2025
5.4Med
CVE-2025-37732 (opens in a new tab)
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.
Elastic Cloud· Dec 15, 2025
4.3Med
CVE-2025-37734 (opens in a new tab)
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
Elastic Cloud· Nov 12, 2025
5.7Med
CVE-2025-37727 (opens in a new tab)
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
Elastic Cloud· Oct 10, 2025
5.4Med
CVE-2025-25018 (opens in a new tab)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)
Elastic Cloud· Oct 10, 2025
6.1Med
CVE-2025-25017 (opens in a new tab)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)
Elastic Cloud· Oct 10, 2025
5.4Med
CVE-2025-37728 (opens in a new tab)
Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.
Elastic Cloud· Oct 7, 2025
5.4Med
CVE-2025-25009 (opens in a new tab)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
Elastic Cloud· Oct 7, 2025
6.5Med
CVE-2025-25010 (opens in a new tab)
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
Elastic Cloud· Aug 28, 2025
5.4Med
CVE-2025-25012 (opens in a new tab)
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
Elastic Cloud· Jun 25, 2025
6.5Med
CVE-2025-37730 (opens in a new tab)
Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set.
Elastic Cloud· May 6, 2025
4.3Med
CVE-2025-25016 (opens in a new tab)
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
Elastic Cloud· May 1, 2025
5.7Med
CVE-2024-11994 (opens in a new tab)
APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs.
Elastic Cloud· May 1, 2025
5.4Med
CVE-2024-11390 (opens in a new tab)
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
Elastic Cloud· May 1, 2025
6.5Med
CVE-2025-25013 (opens in a new tab)
Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack.
Elastic Cloud· Apr 8, 2025
6.5Med
CVE-2024-52980 (opens in a new tab)
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.
Elastic Cloud· Apr 8, 2025
6.5Med
CVE-2024-52974 (opens in a new tab)
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.
Elastic Cloud· Apr 8, 2025
6.5Med
CVE-2024-43708 (opens in a new tab)
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.
Elastic Cloud· Jan 23, 2025
6.5Med
CVE-2024-52972 (opens in a new tab)
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.
Elastic Cloud· Jan 23, 2025
4.3Med
CVE-2024-43710 (opens in a new tab)
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.
Elastic Cloud· Jan 23, 2025
6.5Med
CVE-2024-43707 (opens in a new tab)
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
Elastic Cloud· Jan 23, 2025
6.5Med
CVE-2024-52973 (opens in a new tab)
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.
Elastic Cloud· Jan 21, 2025
5.5Med
CVE-2024-37284 (opens in a new tab)
Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a multibyte character. This leads to an uncaught exception causing Elastic Defend to crash which in turn will prevent it from quarantining the file and/or killing the process.
Elastic Cloud· Jan 21, 2025
6.0Med
CVE-2024-12539 (opens in a new tab)
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
Elastic Cloud· Dec 17, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 2 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.