Elastic
Number 49 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
398
Critical
11
High
62
Known Exploited
3
Exploit available
1
Network, no login needed
7.6%
Of 302 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 196 | 0 | 39 | 155 | 2 | 0 |
| 2025 | 49 | 4 | 11 | 34 | 0 | 0 |
| 2024 | 21 | 3 | 1 | 17 | 0 | 0 |
| 2023 | 31 | 2 | 10 | 16 | 2 | 1 |
| 2022 | 12 | 0 | 0 | 3 | 0 | 9 |
| 2021 | 18 | 0 | 0 | 0 | 0 | 18 |
| 2020 | 12 | 0 | 0 | 0 | 0 | 12 |
| 2019 | 14 | 1 | 0 | 0 | 0 | 13 |
| 2018 | 19 | 0 | 0 | 0 | 0 | 19 |
| 2017 | 24 | 0 | 0 | 0 | 0 | 24 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2015 | 1 | 1 | 0 | 0 | 0 | 0 |
| 2014 | 1 | 0 | 1 | 0 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Kibana | 190 | 46 |
| Elasticsearch | 91 | 8 |
| Elastic Cloud Enterprise | 13 | 4 |
| Logstash | 9 | 2 |
| Packetbeat | 8 | 0 |
| APM Server | 6 | 1 |
| Elastic X-Pack Security | 6 | 0 |
| Fleet Server | 6 | 2 |
| kibana | 6 | 0 |
| Eck Operator | 4 | 0 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Information Disclosure | 42 | 8 |
| Incorrect Authorization | 35 | 9 |
| Denial of Service | 32 | 1 |
| Allocation of Resources Without Limits or Throttling | 30 | 0 |
| Cross-Site Scripting | 26 | 4 |
| Missing Authorization | 20 | 3 |
| Insecure Direct Object Reference | 14 | 4 |
| Uncontrolled Recursion | 12 | 1 |
| Code Injection | 10 | 4 |
| Improper Access Control | 9 | 1 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2019-7609 | Elastic Kibana: Code Injection | Critical | 95.3% | |
| CVE-2015-1427 | Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability | Critical | 99.9% | |
| CVE-2014-3120 | Elasticsearch Remote Code Execution Vulnerability | High | 88.6% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-115716 | Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service | Medium | 0.4% | |
| CVE-2026-115715 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | Medium | 0.3% | |
| CVE-2026-115714 | Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections | High | 0.2% | |
| CVE-2026-115710 | Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure | Medium | 0.2% | |
| CVE-2026-115298 | Incorrect Authorization in Elasticsearch Leading to Information Disclosure | Medium | 0.2% | |
| CVE-2026-115297 | NULL Pointer Dereference in Packetbeat Leading to Denial of Service | Medium | 0.3% | |
| CVE-2026-115295 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure | Medium | 0.3% | |
| CVE-2026-115294 | Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion | High | 0.3% | |
| CVE-2026-115293 | Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure | Medium | 0.4% | |
| CVE-2026-115292 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure | Medium | 0.2% |