Elastic Elasticsearch

• CVE-2025-37731 Medium 6.8 Elasticsearch Improper Authentication 0.2%
• CVE-2025-37727 Medium 5.7 Elasticsearch Insertion of sensitive information in log file 0.3%
• CVE-2024-52979 Medium 6.5 Elasticsearch Uncontrolled Resource Consumption vulnerability 0.7%
• CVE-2024-52981 Medium 4.9 An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow. 0.6%
• CVE-2024-52980 Medium 6.5 Elasticsearch Uncontrolled Resource Consumption vulnerability 0.6%
• CVE-2024-43709 Medium 6.5 Elasticsearch allocation of resources without limits or throttling leads to crash 0.6%
• CVE-2024-12539 Medium 6.0 Elasticsearch Incorrect Authorization 0.5%
• CVE-2024-23444 Medium 4.9 Elasticsearch elasticsearch-certutil csr fails to encrypt private key 0.2%
• CVE-2023-49921 Medium 5.2 An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed i 0.4%
• CVE-2024-37280 Medium 4.9 Elasticsearch StackOverflow vulnerability 0.6%
• CVE-2024-23445 Medium 6.5 Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions 0.5%
• CVE-2024-23449 Medium 4.3 Elasticsearch Uncaught Exception 0.7%
• CVE-2024-23451 Medium 4.4 Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model 0.5%
• CVE-2024-23450 Medium 4.9 Elasticsearch Uncontrolled Resource Consumption vulnerability 1.3%
• CVE-2023-46673 Medium 6.5 It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API. 0.8%
• CVE-2021-37937 Medium 5.9 Elasticsearch privilege escalation 0.7%
• CVE-2023-31417 Medium 4.1 Elasticsearch Insertion of sensitive information in audit logs 0.2%
• CVE-2023-31418 High 7.5 Elasticsearch uncontrolled resource consumption 2.1%
• CVE-2023-31419 Medium 6.5 Elasticsearch StackOverflow vulnerability 61.1%
• CVE-2022-23712 Unrated A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network req 7.5%
• CVE-2022-23708 Unrated A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users 1.0%
• CVE-2021-22147 Unrated Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized t 1.0%
• CVE-2021-22145 Unrated A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query 76.2%
• CVE-2021-22138 Unrated In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not 0.5%
• CVE-2021-22137 Unrated In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when 1.2%
• CVE-2021-22135 Unrated Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The sugg 1.3%
• CVE-2021-22134 Unrated A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when 1.1%
• CVE-2020-7021 Unrated Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive 1.5%
• CVE-2021-22132 Unrated Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user w 1.2%
• CVE-2020-7020 Unrated Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when execu 1.1%
• CVE-2020-7019 Unrated In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recentl 1.4%
• CVE-2020-7014 Unrated The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and al 1.7%
• CVE-2020-7009 Unrated Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can 1.9%