CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 43 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 62%
High: 5824%
Medium: 17973%
Low or not scored: 31%

Matching CVEs: 246; Last two years
Critical: 6; CVSS 9.0 and above
High: 58; CVSS 7.0 to 8.9
Known exploited: 0; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 53 · September 2026

Most CVEs

In each company's software, last two years

Matching CVEs

4.3Med
CVE-2025-68386 (opens in a new tab)
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
Elastic Cloud· Dec 18, 2025
6.1Med
CVE-2025-68385 (opens in a new tab)
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.
Elastic Cloud· Dec 18, 2025
5.3Med
CVE-2025-68388 (opens in a new tab)
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat.
Elastic Cloud· Dec 18, 2025
6.5Med
CVE-2025-68384 (opens in a new tab)
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
Elastic Cloud· Dec 18, 2025
6.5Med
CVE-2025-68383 (opens in a new tab)
Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.
Elastic Cloud· Dec 18, 2025
6.5Med
CVE-2025-68382 (opens in a new tab)
Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service (DoS) through a reliable process crash when handling truncated XDR-encoded RPC messages.
Elastic Cloud· Dec 18, 2025
6.5Med
CVE-2025-68381 (opens in a new tab)
Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number.
Elastic Cloud· Dec 18, 2025
5.4Med
CVE-2025-37732 (opens in a new tab)
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.
Elastic Cloud· Dec 15, 2025
7.4High
CVE-2025-37731 (opens in a new tab)
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
Elastic Cloud· Dec 15, 2025
4.3Med
CVE-2025-37734 (opens in a new tab)
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
Elastic Cloud· Nov 12, 2025
8.8High
CVE-2025-37736 (opens in a new tab)
Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{user_id} patch:/platform/configuration/security/service-accounts/{user_id} post:/platform/configuration/security/service-accounts/{user_id}/keys delete:/platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id} patch:/user post:/users post:/users/auth/keys
Elastic Cloud· Nov 7, 2025
7.0High
CVE-2025-37735 (opens in a new tab)
Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.
Elastic Cloud· Nov 6, 2025
7.2High
CVE-2025-37729 (opens in a new tab)
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.
Elastic Cloud· Oct 13, 2025
5.7Med
CVE-2025-37727 (opens in a new tab)
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
Elastic Cloud· Oct 10, 2025
5.4Med
CVE-2025-25018 (opens in a new tab)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)
Elastic Cloud· Oct 10, 2025
6.1Med
CVE-2025-25017 (opens in a new tab)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)
Elastic Cloud· Oct 10, 2025
5.4Med
CVE-2025-37728 (opens in a new tab)
Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.
Elastic Cloud· Oct 7, 2025
5.4Med
CVE-2025-25009 (opens in a new tab)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
Elastic Cloud· Oct 7, 2025
6.5Med
CVE-2025-25010 (opens in a new tab)
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
Elastic Cloud· Aug 28, 2025
7.0High
CVE-2025-25011 (opens in a new tab)
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
Elastic Cloud· Jul 30, 2025
7.0High
CVE-2025-0712 (opens in a new tab)
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
Elastic Cloud· Jul 30, 2025
5.4Med
CVE-2025-25012 (opens in a new tab)
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
Elastic Cloud· Jun 25, 2025
8.8High
CVE-2024-43706 (opens in a new tab)
Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
Elastic Cloud· Jun 10, 2025
6.5Med
CVE-2025-37730 (opens in a new tab)
Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set.
Elastic Cloud· May 6, 2025
9.8Crit
CVE-2025-25014 (opens in a new tab)
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
Elastic Cloud· May 6, 2025
4.3Med
CVE-2025-25016 (opens in a new tab)
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
Elastic Cloud· May 1, 2025
7.5High
CVE-2024-52979 (opens in a new tab)
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
Elastic Cloud· May 1, 2025
7.8High
CVE-2024-52976 (opens in a new tab)
Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osqueryd configurations.
Elastic Cloud· May 1, 2025
5.7Med
CVE-2024-11994 (opens in a new tab)
APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs.
Elastic Cloud· May 1, 2025
5.4Med
CVE-2024-11390 (opens in a new tab)
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
Elastic Cloud· May 1, 2025
6.5Med
CVE-2025-25013 (opens in a new tab)
Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack.
Elastic Cloud· Apr 8, 2025
9.8Crit
CVE-2024-12556 (opens in a new tab)
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
Elastic Cloud· Apr 8, 2025
7.5High
CVE-2024-52981 (opens in a new tab)
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
Elastic Cloud· Apr 8, 2025
6.5Med
CVE-2024-52980 (opens in a new tab)
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.
Elastic Cloud· Apr 8, 2025
6.5Med
CVE-2024-52974 (opens in a new tab)
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.
Elastic Cloud· Apr 8, 2025
9.9Crit
CVE-2025-25015 (opens in a new tab)
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors
Elastic Cloud· Mar 5, 2025
6.5Med
CVE-2024-43708 (opens in a new tab)
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.
Elastic Cloud· Jan 23, 2025
9.0Crit
CVE-2024-52975 (opens in a new tab)
An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends on the integrations enabled.
Elastic Cloud· Jan 23, 2025
6.5Med
CVE-2024-52972 (opens in a new tab)
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.
Elastic Cloud· Jan 23, 2025
4.3Med
CVE-2024-43710 (opens in a new tab)
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.
Elastic Cloud· Jan 23, 2025
6.5Med
CVE-2024-43707 (opens in a new tab)
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
Elastic Cloud· Jan 23, 2025
6.5Med
CVE-2024-52973 (opens in a new tab)
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.
Elastic Cloud· Jan 21, 2025
7.5High
CVE-2024-43709 (opens in a new tab)
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
Elastic Cloud· Jan 21, 2025
5.5Med
CVE-2024-37284 (opens in a new tab)
Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a multibyte character. This leads to an uncaught exception causing Elastic Defend to crash which in turn will prevent it from quarantining the file and/or killing the process.
Elastic Cloud· Jan 21, 2025
6.0Med
CVE-2024-12539 (opens in a new tab)
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
Elastic Cloud· Dec 17, 2024
7.2High
CVE-2024-37285 (opens in a new tab)
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_inges
Elastic Cloud· Nov 14, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 43 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.