| CVE-2025-37731 |
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client…
|
6.8
Medium
|
Dec 15, 2025 |
| CVE-2025-37727 |
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific…
|
5.7
Medium
|
Oct 10, 2025 |
| CVE-2024-52979 |
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with…
|
6.5
Medium
|
May 1, 2025 |
| CVE-2024-52981 |
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with…
|
4.9
Medium
|
Apr 8, 2025 |
| CVE-2024-52980 |
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of…
|
6.5
Medium
|
Apr 8, 2025 |
| CVE-2024-43709 |
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception…
|
6.5
Medium
|
Jan 21, 2025 |
| CVE-2024-12539 |
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious…
|
6.0
Medium
|
Dec 17, 2024 |
| CVE-2024-23444 |
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in…
|
4.9
Medium
|
Jul 31, 2024 |
| CVE-2023-49921 |
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level
|
5.2
Medium
|
Jul 26, 2024 |
| CVE-2024-37280 |
A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field…
|
4.9
Medium
|
Jun 13, 2024 |
| CVE-2024-23445 |
It was identified that if a cross-cluster API key…
|
6.5
Medium
|
Jun 12, 2024 |
| CVE-2024-23449 |
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment…
|
4.3
Medium
|
Mar 29, 2024 |
| CVE-2024-23451 |
Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently…
|
4.4
Medium
|
Mar 27, 2024 |
| CVE-2024-23450 |
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node…
|
4.9
Medium
|
Mar 27, 2024 |
| CVE-2023-46673 |
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch…
|
6.5
Medium
|
Nov 22, 2023 |
| CVE-2021-37937 |
An issue was found with how API keys are created with the Fleet-Server service account
|
5.9
Medium
|
Nov 22, 2023 |
| CVE-2023-31417 |
Elasticsearch generally filters out sensitive information and credentials before logging to the audit log
|
4.1
Medium
|
Oct 26, 2023 |
| CVE-2023-31418 |
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer
|
7.5
High
|
Oct 26, 2023 |
| CVE-2023-31419 |
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause…
|
6.5
Medium
|
Oct 26, 2023 |
| CVE-2022-23712 |
A Denial of Service flaw was discovered in Elasticsearch
|
Not rated
|
Jun 6, 2022 |
| CVE-2022-23708 |
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would…
|
Not rated
|
Mar 3, 2022 |
| CVE-2021-22147 |
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots
|
Not rated
|
Sep 15, 2021 |
| CVE-2021-22145 |
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting
|
Not rated
|
Jul 21, 2021 |
| CVE-2021-22138 |
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the…
|
Not rated
|
May 13, 2021 |
| CVE-2021-22137 |
In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level…
|
Not rated
|
May 13, 2021 |