| CVE-2025-25018 |
Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)
|
8.7
High
|
Oct 10, 2025 |
| CVE-2025-25009 |
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload
|
8.7
High
|
Oct 7, 2025 |
| CVE-2025-37728 |
Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked
|
5.4
Medium
|
Oct 7, 2025 |
| CVE-2025-25010 |
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which…
|
6.5
Medium
|
Aug 28, 2025 |
| CVE-2025-25012 |
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and…
|
4.3
Medium
|
Jun 25, 2025 |
| CVE-2024-43706 |
Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint
|
7.6
High
|
Jun 10, 2025 |
| CVE-2025-25014 |
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine…
|
9.1
Critical
|
May 6, 2025 |
| CVE-2024-11390 |
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s…
|
5.4
Medium
|
May 1, 2025 |
| CVE-2025-25016 |
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a…
|
4.3
Medium
|
May 1, 2025 |
| CVE-2024-12556 |
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal
|
8.7
High
|
Apr 8, 2025 |
| CVE-2024-52974 |
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana…
|
6.5
Medium
|
Apr 8, 2025 |
| CVE-2025-25015 |
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted…
|
9.9
Critical
|
Mar 5, 2025 |
| CVE-2024-43708 |
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted…
|
6.5
Medium
|
Jan 23, 2025 |
| CVE-2024-52972 |
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted…
|
6.5
Medium
|
Jan 23, 2025 |
| CVE-2024-43707 |
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could…
|
7.7
High
|
Jan 23, 2025 |
| CVE-2024-43710 |
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used…
|
4.3
Medium
|
Jan 23, 2025 |
| CVE-2024-52973 |
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted…
|
6.5
Medium
|
Jan 21, 2025 |
| CVE-2024-37285 |
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document…
|
9.1
Critical
|
Nov 14, 2024 |
| CVE-2024-37288 |
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document…
|
9.9
Critical
|
Sep 9, 2024 |
| CVE-2024-37287 |
A flaw allowing arbitrary code execution was discovered in Kibana
|
9.1
Critical
|
Aug 13, 2024 |
| CVE-2024-37281 |
An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a…
|
6.5
Medium
|
Jul 30, 2024 |
| CVE-2024-23443 |
A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a…
|
4.9
Medium
|
Jun 19, 2024 |
| CVE-2024-23442 |
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if…
|
6.1
Medium
|
Jun 14, 2024 |
| CVE-2024-37279 |
A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule…
|
4.3
Medium
|
Jun 13, 2024 |
| CVE-2024-23446 |
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security…
|
6.5
Medium
|
Feb 7, 2024 |