CVE-2026-33462Medium 4.6Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts0.2%
CVE-2026-33458Medium 6.8Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure0.2%
CVE-2026-33459Medium 6.5Uncontrolled Resource Consumption in Kibana Leading to Denial of Service0.3%
CVE-2026-33460Medium 4.3Incorrect Authorization in Kibana Fleet Leading to Information Disclosure0.2%
CVE-2026-33461High 7.7Incorrect Authorization in Kibana Fleet Leading to Information Disclosure0.3%
CVE-2026-4498High 7.7Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope0.3%
CVE-2026-26940Medium 6.5Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service0.3%
CVE-2026-26939Medium 6.5Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration0.2%
CVE-2026-26938High 8.6Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)0.3%
CVE-2026-26937Medium 6.5Uncontrolled Resource Consumption in Kibana Leading to Denial of Service0.3%
CVE-2026-26936Medium 4.9Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service0.4%
CVE-2026-26935Medium 6.5Improper Input Validation in Kibana Leading to Denial of Service0.3%
CVE-2026-26934Medium 6.5Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service0.3%
CVE-2026-0532High 8.6External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector0.5%
CVE-2026-0543Medium 6.5Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation0.4%
CVE-2026-0531Medium 6.5Allocation of Resources Without Limits or Throttling in Kibana Fleet0.5%
CVE-2026-0530Medium 6.5Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation0.3%
CVE-2025-37735High 7.0Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could resul0.1%
CVE-2025-25014Critical 9.1Kibana arbitrary code execution via prototype pollution22.3%
CVE-2024-11390Medium 5.4Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS0.4%
CVE-2025-25016Medium 4.3Kibana Unrestricted Upload of File0.3%
CVE-2024-12556High 8.7Kibana Prototype Pollution can lead to code injection0.6%
CVE-2024-52974Medium 6.5An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash.
A successful attack requires a malicious user to have read permissi0.4%
CVE-2025-25015Critical 9.9Kibana arbitrary code execution via prototype pollution1.3%
CVE-2024-43708Medium 6.5An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with re0.4%
CVE-2024-52972Medium 6.5Kibana allocation of resources without limits or throttling leads to crash0.4%
CVE-2024-43707High 7.7Kibana exposure of sensitive information to an unauthorized actor0.4%
CVE-2024-52973Medium 6.5Kibana allocation of resources without limits or throttling leads to crash0.4%
CVE-2024-37285Critical 9.1Kibana arbitrary code execution via YAML deserialization1.2%
CVE-2024-37288Critical 9.9A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Secur1.0%
CVE-2024-37287Critical 9.1Kibana arbitrary code execution via prototype pollution1.6%
CVE-2024-37281Medium 6.5Kibana Denial of Service issue0.4%
CVE-2024-23443Medium 4.9A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.1.8%