Elastic

Products

Exploited and recent CVEs

• CVE-2019-7609 Critical 9.8 Exploited Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt 95.3%
• CVE-2026-115714 High 7.4 Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections 0.2%
• CVE-2026-115716 Medium 6.5 Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service 0.4%
• CVE-2026-115715 Medium 6.5 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service 0.3%
• CVE-2026-115710 Medium 4.2 Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure 0.2%
• CVE-2026-115298 Medium 4.3 Incorrect Authorization in Elasticsearch Leading to Information Disclosure 0.2%
• CVE-2026-115297 Medium 6.5 NULL Pointer Dereference in Packetbeat Leading to Denial of Service 0.3%
• CVE-2026-115295 Medium 4.3 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure 0.3%
• CVE-2026-115294 High 7.3 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion 0.3%
• CVE-2026-115293 Medium 6.5 Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure 0.3%
• CVE-2026-115292 Medium 4.3 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure 0.2%
• CVE-2026-115290 High 7.5 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service 0.4%
• CVE-2026-115289 Medium 4.3 Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure 0.2%
• CVE-2026-115713 High 7.5 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification 0.2%
• CVE-2026-115712 Medium 4.3 Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings 0.2%
• CVE-2026-115711 Medium 6.4 Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure 0.2%
• CVE-2026-115709 High 8.2 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss 0.3%
• CVE-2026-115708 High 7.2 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass 0.2%
• CVE-2026-115707 Medium 6.4 Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation 0.1%
• CVE-2026-115706 Medium 6.8 Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation 0.2%
• CVE-2026-103009 High 7.1 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure 0.2%
• CVE-2026-103008 Medium 6.5 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service 0.3%
• CVE-2026-103007 High 7.2 Incorrect Authorization in Elasticsearch Leading to Privilege Escalation 0.3%
• CVE-2026-103006 Medium 6.5 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service 0.4%
• CVE-2026-103005 Medium 6.5 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service 0.3%
• CVE-2026-102413 Medium 6.2 Uncaught Exception in Elastic Endpoint Leading to Denial of Service 0.1%
• CVE-2026-102412 Medium 6.5 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure 0.3%
• CVE-2026-102411 Medium 6.5 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service 0.3%
• CVE-2026-102410 Medium 4.3 Missing Authorization in Kibana Leading to Information Disclosure 0.2%
• CVE-2026-102409 Medium 6.5 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service 0.3%